Executive brief
Keycloak is an open-source identity and access management system that organizations use to control who can access their applications. A vulnerability in its WebAuthn registration component allows attackers to register fake or untrusted authentication devices even when the system is configured to prevent this, potentially allowing unauthorized access to protected systems.
Technical details
A flaw exists in Keycloak's WebAuthn registration component where attestation policy validation is insufficiently enforced. An attacker can bypass configured attestation requirements by submitting an attestation object with fmt set to "none", registering untrusted or forged authenticators even when the realm is configured to require direct attestation. This occurs because the component does not properly validate that the attestation format complies with the configured policy. The vulnerability is exploitable over the network during the WebAuthn registration flow and does not require prior authentication. A successful exploit weakens authentication integrity by allowing registration of non-genuine authenticators.
Affected products
- Keycloak Keycloak <UNKNOWN>
Timeline
- 2026-02-27: disclosed