REDHAT-BUG-2455329: Medium severity Red Hat Keycloak vulnerability

Authentication / credential-enrollment vulnerability in Keycloak’s handling of ExecuteActionsActionToken for WebAuthn flows. The flaw is caused by canUseTokenRepeatedly() treating tokens as reusable when required actions do not mark themselves as one-time, so tokens containing WEBAUTHNREGISTER or WEBAUTHNPASSWORDLESSREGISTER can be replayed within their validity window. When an attacker gains access to an execute-actions email link, they can complete WebAuthn registration with their own authenticator on the victim’s account before the victim uses it. This can be exploited remotely when WebAuthn required actions are enabled and the link is obtained via email interception, log leakage, or mailbox compromise. Successful exploitation results in unauthorized enrollment of a hardware-backed credential, enabling stealthy and persistent account takeover.