Bug 2479565 (CVE-2026-8830) - CVE-2026-8830 keycloak: org.keycloak/keycloak-services: Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation
Summary: CVE-2026-8830 keycloak: org.keycloak/keycloak-services: Keycloak: Policy bypa...
Keywords:
Status: NEW
Alias: CVE-2026-8830
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-18 13:09 UTC by OSIDB Bzimport
Modified: 2026-05-19 06:04 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-18 13:09:22 UTC
During WebAuthn credential registration, the server-side processAction() fails to validate that the newly created credential's parameters (such as public key algorithms) match the realm's configured WebAuthn policies. This allows a user to bypass administrative restrictions (e.g., algorithm requirements, user verification, or resident key configuration) by modifying client-side JavaScript during the registration process.


Note You need to log in before you can comment on or make changes to this bug.