Description
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
Affected products
redhat: build of keycloak; redhat: keycloak
References7
- access.redhat.com/errata/RHSA-2025:21370 Vendor Advisory
- access.redhat.com/errata/RHSA-2025:21371 Vendor Advisory
- access.redhat.com/errata/RHSA-2025:22088 Vendor Advisory
- access.redhat.com/errata/RHSA-2025:22089 Vendor Advisory
- access.redhat.com/security/cve/CVE-2025-12150 Vendor Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2406192 Issue Tracking
- github.com/keycloak/keycloak/issues/43723 Issue Tracking
Metrics
- CVSS 3.1
-
3.1
LOW
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - EPSS — exploit probability
- 0% percentile: 14 · as of 12 November 2026
- CWE
- CWE-347
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.