CVE-2026-8830
WebAuthn Policy Bypass in Keycloak via Client-Side Manipulation
Publication date: 2026-05-19
Last updated on: 2026-05-19
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | keycloak | to 3.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-603 | A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Keycloak and allows an authenticated user to bypass the configured WebAuthn policies during credential registration by manipulating client-side JavaScript.
The root cause is that the server-side processAction() function does not properly validate that the parameters of the newly created credential, such as public key algorithms, conform to the realm's configured WebAuthn policies.
As a result, users can create credentials that do not adhere to the administrative security requirements set by the system.
How can this vulnerability impact me? :
This vulnerability can weaken the overall security posture of the system by allowing the creation of authentication credentials that bypass established security policies.
Attackers or users could register credentials that use weaker or non-compliant authentication methods, potentially increasing the risk of unauthorized access or credential misuse.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an authenticated user to bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. As a result, credentials that do not adhere to administrative security requirements can be created.
Because the server-side process does not validate that the newly created credential's parameters match the realm's configured WebAuthn policies, this could weaken the overall security posture of the system.
Such weakening of security controls may lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require strict authentication and security measures to protect sensitive data.