← Back to CVEs
CVE-2025-12150
LOW3.1
Description
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
CVE Details
CVSS v3.1 Score3.1
SeverityLOW
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack VectorNETWORK
ComplexityHIGH
Privileges RequiredNONE
User InteractionREQUIRED
Published2/27/2026
Last Modified3/5/2026
Sourcenvd
Honeypot Sightings0
Affected Products
redhat:build_of_keycloakredhat:keycloak
Weaknesses (CWE)
CWE-347
References
https://access.redhat.com/errata/RHSA-2025:21370(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2025:21371(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2025:22088(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2025:22089(secalert@redhat.com)
https://access.redhat.com/security/cve/CVE-2025-12150(secalert@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2406192(secalert@redhat.com)
https://github.com/keycloak/keycloak/issues/43723(secalert@redhat.com)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.