Low severity · published Feb 27, 2026
CVE-2025-12150
Org.keycloak/keycloak-services: webauthn attestation statement verification bypass
3.1
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat build of Keycloak 26.2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Keycloak 26.4 · Red Hat
All versions, or not specified · source: vendor
KE
keycloak · Keycloak
before 26.4.4 · source: vendor, NVD
BO
Build OF Keycloak · Redhat
before 26.4.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12150
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12150
Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:21370
Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:21371
Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:22088
Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:22089
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-12150
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2406192
More from keycloak
8.8
CVE-2017-12161
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request
8.8
CVE-2014-3709
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF)…
8.1
CVE-2026-1609
Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
7.5
CVE-2014-3651
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR…
7.5
CVE-2017-12159
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session