PT-2026-22313 · Red Hat · Keycloak

Published 2026-02-27 · Updated 2026-03-05 · CVE-2025-12150

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak’s WebAuthn registration component. This allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators by submitting an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2025-12150

GHSA-7G5X-9C4V-4W5R

Affected Products

Keycloak

References · 18

• https://access.redhat.com/errata/RHSA-2025:21371 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:22088 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-12150 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:21370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12150 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12150 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:22089 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7g5x-9c4v-4w5r · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/43723 · Note
• https://github.com/keycloak/keycloak/issues/35110 · Note
• https://github.com/keycloak/keycloak/commit/4136a677e7e24f6685ed25567e191e1003200339 · Note
• https://twitter.com/VulmonFeeds/status/2027418387815481525 · Twitter Post
• https://t.me/cveNotify/153442 · Telegram Post
• https://twitter.com/CVEnew/status/2027380176040886459 · Twitter Post