EUVD-2026-30886
GHSA-w4p5-rfh6-cwrv
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 61 maven packages depend on org.keycloak:keycloak-services (28 direct, 33 indirect)
Ecosystem-wide dependent count for version 26.6.2.
DescriptionCVE.org
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ExecuteActionsActionToken tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
AnalysisAI
Token replay exploitation in Red Hat Build of Keycloak's WebAuthn flow allows an unauthenticated remote attacker who intercepts an ExecuteActionsActionToken email link to enroll their own hardware-backed WebAuthn authenticator to a victim's account. Successful exploitation bypasses authentication entirely and grants the attacker persistent, credential-backed access to the compromised account. No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent, but the High confidentiality and integrity impact from CVSS underscores the severity if the attack preconditions are met.
Technical ContextAI
Red Hat Build of Keycloak is an enterprise identity and access management (IAM) platform derived from the upstream Keycloak project. The vulnerability resides in the WebAuthn (Web Authentication API) registration flow, specifically in how Keycloak validates and enforces single-use semantics on ExecuteActionsActionTokens - short-lived signed tokens distributed via email to trigger user-side actions such as required action completion or credential setup. The root cause is improper token replay protection: the token either is not invalidated after its first use, is not bound to a specific session or context, or the WebAuthn registration path does not enforce the token's intended scope. Although no CWE is formally assigned in the submission, this maps conceptually to replay attack weaknesses (analogous to CWE-294: Authentication Bypass by Capture-replay). The affected CPE cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:* covers all tracked versions of Red Hat's Keycloak build with no version ceiling confirmed in the available data.
RemediationAI
No specific patched version number was provided in the available intelligence data; the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-37982 should be consulted for the authoritative fix version once published. Until a patch is applied, compensating controls should focus on limiting the attack surface of the vulnerable token flow: disable WebAuthn registration via email-triggered execute-actions workflows if WebAuthn enrollment can be enforced through a separate, administrator-controlled channel (trade-off: reduces self-service enrollment capability). Reduce token TTL for ExecuteActionsActionTokens to the shortest operationally feasible window to shrink the interception and replay window. Enforce email delivery over TLS and audit mail relay configurations to reduce interception risk. Monitor Keycloak audit logs for unexpected WebAuthn credential registrations, particularly those occurring on accounts where the user did not initiate registration. The Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2455329 may contain interim guidance or patch commits as the fix progresses.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today