← Voltar para CVEs

CVE-2025-12150

LOW

3.1

Descricao

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

Detalhes CVE

Pontuacao CVSS v3.13.1

SeveridadeLOW

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado2/27/2026

Ultima modificacao3/5/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

redhat:build_of_keycloakredhat:keycloak

Fraquezas (CWE)

CWE-347

Referencias

https://access.redhat.com/errata/RHSA-2025:21370(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:21371(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:22088(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2025:22089(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2025-12150(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2406192(secalert@redhat.com)

https://github.com/keycloak/keycloak/issues/43723(secalert@redhat.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.