A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to
    bypass the configured attestation policy and register untrusted or forged authenticators via submission of
    an attestation object with fmt: "none", even when the realm is configured to require direct attestation.
    This can lead to weakened authentication integrity and unauthorized authenticator registration.
    (CVE-2025-12150)

ID	Name	Product	Family	Type	Severity
461932	Echo: org.keycloak:keycloak-services: security update to 26.4.4	Tenable Cloud Security	Echo Local Security Checks	Local	low
461932	Echo: org.keycloak:keycloak-services: security update to 26.4.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
438039	SCA: security update for org.keycloak:keycloak-services (GHSA-7g5x-9c4v-4w5r)	Tenable Cloud Security	SCA Checks	Local	low
438039	SCA: security update for org.keycloak:keycloak-services (GHSA-7g5x-9c4v-4w5r)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2025-12150

low

Tenable Plugins

low

low

low

low