CVE-2025-12150CWE-347

CVE-2025-12150

Low · published February 27, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-02-27T14:16Z
Affected products (3)
ProductVersionsFixed in
redhat/build_of_keycloak< 26.4.426.4.4
redhat/build_of_keycloakall versions—
redhat/keycloakall versions—
References (7)
https://access.redhat.com/errata/RHSA-2025:21370 · [email protected]https://access.redhat.com/errata/RHSA-2025:21371 · [email protected]https://access.redhat.com/errata/RHSA-2025:22088 · [email protected]https://access.redhat.com/errata/RHSA-2025:22089 · [email protected]https://access.redhat.com/security/cve/CVE-2025-12150 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2406192 · [email protected]https://github.com/keycloak/keycloak/issues/43723 · [email protected]
EPSS history
Timeline
  • 27 FEB 08:10Z
    Org.keycloak/keycloak-services: webauthn attestation statement verification bypass
    cvelistv5