PT-2026-41833 · Red Hat · Keycloak

Osidb Bzimport · CVE-2026-8830 · Published 2026-05-19 · Updated 2026-06-26

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. The issue exists because the server-side processAction() function fails to validate that parameters of the newly created credential, such as public key algorithms, align with the realm's configured WebAuthn policies. This may result in the creation of credentials that do not meet administrative security requirements, potentially allowing non-compliant authentication methods.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-603

Related Identifiers

CVE-2026-8830

GHSA-G8VR-X4QH-25QG

Affected Products

Keycloak

References · 19

• https://bugzilla.redhat.com/show_bug.cgi?id=2479565 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30050 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8830 · Security Note
• https://access.redhat.com/errata/RHSA-2026:25097 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g8vr-x4qh-25qg · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-8830 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25098 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/47b9aef70948564151af85fd52e0d7e508c76490 · Note
• https://github.com/keycloak/keycloak/commit/d3da77ef363d698e7a74470ba52fcdce09e394c4 · Note
• https://github.com/keycloak/keycloak/pull/49344 · Note
• https://github.com/keycloak/keycloak/issues/49133 · Note
• https://t.me/cveNotify/176651 · Telegram Post
• https://t.me/cveNotify/176475 · Telegram Post