Keycloak: Unauthorized account takeover via WebAuthn token replay

MOYENNE 6.8CVE-2026-37982 · BIT-keycloak-2026-37982 · GHSA-w4p5-rfh6-cwrv · Published 19/05/2026 · updated 29/10/2026

En bref

CVE-2026-37982 est une vulnérabilité MOYENNE (CVSS 6.8) touchant org.keycloak:keycloak-services, build of keycloak (redhat).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.44%, plus élevée que 38.3% des vulnérabilités.
Correctif : mettre à jour vers 26.6.2, 26.4.12 ou plus récent.

Package	Affected versions	Patched versions
org.keycloak:keycloak-services Maven	`< 26.6.2`	`26.6.2`
build of keycloak redhat	`≥ 26.4, < 26.4.12`	`26.4.12`

Description

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ExecuteActionsActionToken tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

NVD description

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.