Red Hat Keycloak EUVD-2026-30886

The following specific conditions must be present for exploitation: (1) The Keycloak deployment must have the WebAuthn authenticator configured and active within the authentication flow; (2) The attacker must intercept or otherwise obtain a valid, unexpired ExecuteActionsActionToken delivered to the victim via email - this is the primary high-complexity barrier reflected in AC:H; (3) User interaction (UI:R) is required, likely meaning the email link must have been triggered by an administrator or by the victim requesting a required-action email, creating the token in the first place; (4) The token must not yet have been invalidated through expiry or prior use. Exploitation is limited by the requirement to compromise the email delivery channel or otherwise obtain the token out-of-band - this rules out opportunistic mass exploitation. Authentication level for the attacker is PR:N (no Keycloak account needed), but email channel access is the de-facto prerequisite. Deployments not using WebAuthn enrollment via email-triggered flows are not exposed to this specific attack path.

The CVSS 3.1 base score of 6.8 (Medium) is shaped by AV:N (network-reachable), AC:H (high attack complexity), PR:N (no attacker privileges required), and UI:R (user interaction required). The AC:H and UI:R factors are the primary score-depressors: the attacker must succeed in intercepting or obtaining the victim's execute-actions email link, a non-trivial precondition requiring either email channel access, phishing, or a man-in-the-middle position. Despite the moderate score, the downstream impact is severe - C:H and I:H reflect full account compromise and persistent attacker-controlled credential enrollment, which is a worst-case identity outcome. No EPSS score was provided in the intelligence data, preventing probabilistic exploitation likelihood comparison. The vulnerability is not listed in CISA KEV, and no public POC has been identified at time of analysis, suggesting exploitation remains targeted or theoretical rather than widespread. SSVC assessment: exploitation status is 'none/proof-of-concept unknown', automatable is 'no' (AC:H and UI:R preclude mass scanning), technical impact is 'total' given persistent account takeover. Overall, this is a lower-probability but high-consequence vulnerability - prioritize remediation for Keycloak deployments where WebAuthn is actively used and email channel security cannot be guaranteed.

An attacker with the ability to intercept or obtain a victim's execute-actions email - through phishing, email forwarding misconfiguration, or compromised mail relay - extracts the ExecuteActionsActionToken embedded in the link. The attacker then initiates or replays the WebAuthn registration flow against the Keycloak instance using this token, registering their own hardware security key or passkey as an authenticator on the victim's account. From this point forward, the attacker can authenticate as the victim using their own device, maintaining persistent account access even if the victim subsequently changes their password.