CVE-2025-12150: Org.keycloak/keycloak-services: webauthn attestation statement verification bypass
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
Other sources
WebAuthn Attestation Statement verification can be bypassed, which allows registration of arbitrary authenticators even when direct attestation and AAGUID restrictions should be enforced.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.4.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12150?
CVE-2025-12150 has been classified as a high-severity vulnerability due to its potential to compromise security by allowing untrusted authenticators.
How do I fix CVE-2025-12150?
To fix CVE-2025-12150, it is recommended to apply the latest patches or updates provided by Keycloak for the affected software.
What does CVE-2025-12150 affect?
CVE-2025-12150 affects the Keycloak services specifically relating to the WebAuthn registration component.
How does CVE-2025-12150 exploit WebAuthn?
CVE-2025-12150 exploits WebAuthn by allowing attackers to bypass configured attestation policies and register fraudulent authenticators.
What should I do if I am using an affected version related to CVE-2025-12150?
If you are using an affected version related to CVE-2025-12150, you should immediately update to a secure version that addresses this vulnerability.