Keycloak: Unauthorized account takeover via WebAuthn token replay

TRUNG BÌNH 6.8CVE-2026-37982 · BIT-keycloak-2026-37982 · GHSA-w4p5-rfh6-cwrv · Công bố 19/05/2026 · cập nhật 29/10/2026

Tóm tắt nhanh

CVE-2026-37982 là lỗ hổng mức TRUNG BÌNH (CVSS 6.8) ảnh hưởng org.keycloak:keycloak-services, build of keycloak (redhat).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.44%, cao hơn 38.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 26.6.2, 26.4.12 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.keycloak:keycloak-services Maven	`< 26.6.2`	`26.6.2`
build of keycloak redhat	`≥ 26.4, < 26.4.12`	`26.4.12`

Mô tả

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ExecuteActionsActionToken tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

Mô tả của NVD

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.