Executive brief
Keycloak, a popular open-source identity and access management solution, is vulnerable to an account takeover flaw. An attacker who intercepts a specific account action email link can register their own security key to a victim's account. This allows the attacker to gain persistent, unauthorized access to the user's account and the corporate resources it protects.
Technical details
A capture-replay vulnerability (CWE-294) exists in Keycloak's handling of 'ExecuteActionsActionToken' during WebAuthn registration flows. The root cause is located in the 'canUseTokenRepeatedly()' function, which incorrectly treats tokens as reusable when the associated required actions (such as WEBAUTHN_REGISTER) do not explicitly mark themselves as one-time use. A remote attacker who intercepts an 'execute-actions' email link—via log leakage, mailbox compromise, or network interception—can replay the token to register their own hardware-backed credential before the legitimate user. This results in persistent account takeover. The vulnerability is patched in Keycloak 26.6.2 and Red Hat build of Keycloak 26.4.12.
Affected products
- Keycloak Keycloak < 26.6.2
- Red Hat Red Hat build of Keycloak < 26.4.12
Timeline
- 2026-04-06: other: Vulnerability reported to Red Hat Bugzilla
- 2026-05-19: disclosed: CVE-2026-37982 published
- 2026-05-19: advisory: GitHub Advisory GHSA-w4p5-rfh6-cwrv published
- 2026-05-20: patched: Red Hat released security updates for Keycloak 26.4.12