BIT-keycloak-2025-12150

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2025-12150.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-keycloak-2025-12150

Aliases

Published

2026-08-25T11:41:28Z

Modified

2026-09-08T08:48:06Z

Summary

Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

Details

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

Database specific

{
    "cpes": [
        "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:text-only:*:*:*",
        "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"
    ],
    "severity": "Low"
}

References

Affected packages

Bitnami / keycloak

Package

Name: keycloak
Purl: pkg:bitnami/keycloak

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

26.4.4

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2025-12150.json"