CVE-2026-37982: Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ExecuteActionsActionToken tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
Other sources
Authentication / credential-enrollment vulnerability in Keycloak’s handling of ExecuteActionsActionToken for WebAuthn flows. The flaw is caused by canUseTokenRepeatedly() treating tokens as reusable when required actions do not mark themselves as one-time, so tokens containing WEBAUTHNREGISTER or WEBAUTHNPASSWORDLESSREGISTER can be replayed within their validity window. When an attacker gains access to an execute-actions email link, they can complete WebAuthn registration with their own authenticator on the victim’s account before the victim uses it. This can be exploited remotely when WebAuthn required actions are enabled and the link is obtained via email interception, log leakage, or mailbox compromise. Successful exploitation results in unauthorized enrollment of a hardware-backed credential, enabling stealthy and persistent account takeover.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37982?
CVE-2026-37982 is classified as a medium severity vulnerability due to its potential for unauthorized account takeover.
How do I fix CVE-2026-37982?
To fix CVE-2026-37982, update your Keycloak installation to the latest patched version provided by Keycloak.
What impact does CVE-2026-37982 have on my Keycloak installation?
CVE-2026-37982 allows remote attackers to perform unauthorized account takeover via replaying authentication tokens.
Which versions of Keycloak are affected by CVE-2026-37982?
CVE-2026-37982 affects multiple versions of Keycloak that utilize the WebAuthn authentication flow.
Is CVE-2026-37982 a known issue with WebAuthn in Keycloak?
Yes, CVE-2026-37982 is a recognized flaw in the WebAuthn authentication flow within Keycloak.