CVE-2025-12150: Keycloak Services WebAuthn Attestation Statement Verification Bypass
Summary
CVE-2025-12150: Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass. Affects org.keycloak:keycloak-services versions < 26.4.4. Fixed in 26.4.4. How to fix ↓
Also tracked for
- keycloak · Bitnami
The same CVE-2025-12150 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that enables secure authentication and authorization for applications and services. It provides features such as single sign-on, user federation, and identity brokering. The Keycloak REST Services component is responsible for handling authentication requests, including WebAuthn, which allows users to register and authenticate using hardware security keys. However, a vulnerability in the WebAuthn registration component can lead to serious security implications.
Vulnerability Detail
A flaw was identified in Keycloak's WebAuthn registration component that allows attackers to bypass the configured attestation policy. Specifically, an attacker can submit an attestation object with fmt: 'none', enabling the registration of untrusted or forged authenticators even if the realm is set to require direct attestation. This vulnerability compromises the integrity of authentication processes and can lead to unauthorized access through the registration of illegitimate authenticators.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.4.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable WebAuthn registration until the package is updated. This can be done by modifying the Keycloak configuration settings to prevent users from registering new authenticators until the vulnerability is patched.
Conclusion
CVE-2025-12150 represents a significant vulnerability in Keycloak's WebAuthn registration component, allowing for the bypass of attestation policies. It is crucial for users to update to version 26.4.4 or later to mitigate this risk. Temporary workarounds are available, but the best course of action is to apply the patch as soon as possible.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
The vulnerability allows attackers to register untrusted authenticators, potentially leading to unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Consider disabling WebAuthn registration as a temporary workaround until you can apply the update.
The CVSS score for this vulnerability is 3.1, indicating a low severity level.
You can visit the official Keycloak documentation and security advisories for more information on vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
