Bug 2455329 (CVE-2026-37982)

Summary: CVE-2026-37982 keycloak: org.keycloak.authentication: Keycloak: Unauthorized account takeover via WebAuthn token replay
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-06-23   

Description OSIDB Bzimport 2026-04-06 08:00:32 UTC 
Authentication / credential-enrollment vulnerability in Keycloak’s handling of ExecuteActionsActionToken for WebAuthn flows. The flaw is caused by canUseTokenRepeatedly() treating tokens as reusable when required actions do not mark themselves as one-time, so tokens containing WEBAUTHN_REGISTER or WEBAUTHN_PASSWORDLESS_REGISTER can be replayed within their validity window. When an attacker gains access to an execute-actions email link, they can complete WebAuthn registration with their own authenticator on the victim’s account before the victim uses it. This can be exploited remotely when WebAuthn required actions are enabled and the link is obtained via email interception, log leakage, or mailbox compromise. Successful exploitation results in unauthorized enrollment of a hardware-backed credential, enabling stealthy and persistent account takeover.