CVE-2025-12150

The record

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

Affected packages

Related vulnerabilities

• GHSA-7g5x-9c4v-4w5r Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass Same vulnerability
• GHSA-fjf4-6f34-w64q Keycloak: Missing Check on Disabled Client for Docker Registry Protocol Also affects org.keycloak:keycloak-services
• CVE-2026-2733 A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens… Also affects org.keycloak:keycloak-services
• GHSA-37gf-gmxv-74wv Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens Also affects org.keycloak:keycloak-services
• GHSA-hcvw-475w-8g7p Keycloak affected by improper invitation token validation Also affects org.keycloak:keycloak-services
• GHSA-fm6w-rrp3-2x4w Keycloak Affected by Broken Access Control Vulnerability in the… Also affects org.keycloak:keycloak-services
• CVE-2026-1486 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-services
• CVE-2026-1529 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-services