← Volver a CVEs

CVE-2025-12150

LOW

3.1

Descripcion

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

Detalles CVE

Puntuacion CVSS v3.13.1

SeveridadLOW

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado2/27/2026

Ultima modificacion3/5/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

redhat:build_of_keycloakredhat:keycloak

Debilidades (CWE)

CWE-347

Referencias

https://access.redhat.com/errata/RHSA-2025:21370(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:21371(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:22088(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:22089(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2025-12150(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2406192(secalert@redhat.com)

https://github.com/keycloak/keycloak/issues/43723(secalert@redhat.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.