CVE-2026-8830 Details
Description
A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.
A vulnerability in Keycloak allows authenticated users to bypass WebAuthn policies during credential registration. This issue arises because the server-side processAction() does not properly validate that the parameters of newly created credentials, such as public key algorithms, align with the realm's WebAuthn policy settings. As a result, credentials that fail to meet security requirements can be registered, potentially undermining the system's overall security by permitting non-compliant authentication methods.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-603 | Use of Client-Side Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| redhat build of keycloak | All versions |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 26, 2026 | CVE Modified | [email protected] |
| Jun 26, 2026 | CVE Modified | [email protected] |
| Jun 25, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | CVE Modified | [email protected] |
| Jun 10, 2026 | CVE Modified | [email protected] |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 19, 2026 | New CVE Received | [email protected] |