---
id: CVE-2025-12150
title: A flaw was found in Keycloak’s WebAuthn registration component
summary: >-
  A flaw was found in Keycloak’s WebAuthn registration component. This
  vulnerability allows an attacker to bypass the configured attestation policy
  and register untrusted or forged authenticators via submission of an
  attestation object wit…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-347
vendor: redhat
product: build_of_keycloak
affected:
  - build_of_keycloak < 26.4.4
  - build_of_keycloak
  - keycloak = 24.0.2
patched:
  - build_of_keycloak 26.4.4
published: '2026-02-27'
updated: '2026-08-09'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-12150'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:21370'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:21371'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22088'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:22089'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-12150'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2406192'
    label: secalert@redhat.com
  - url: 'https://github.com/keycloak/keycloak/issues/43723'
    label: secalert@redhat.com
tags:
  - nvd
epss: 0.00202
epssPercentile: 0.08862
ingestedAt: '2026-08-09T19:34:40.706Z'
---

## Overview

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

## Affected

- `build_of_keycloak < 26.4.4`
- `build_of_keycloak`
- `keycloak = 24.0.2`

## Remediation

Upgrade past the affected range:

- `build_of_keycloak 26.4.4`