A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay
    `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting
    an execute-actions email link, an attacker can register their own authenticator to a victim's account.
    This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account
    takeover. (CVE-2026-37982)

Keycloak versions installed prior to 26.6.2 are affected by multiple vulnerabilities, including:

  - A flaw was found in Keycloak's redirect URI validation logic. An attacker can bypass     validation to redirect users to malicious sites, potentially leading to phishing attacks and     credential theft. (CVE-2026-7504)

  - A session fixation vulnerability exists in the OIDC login flow. An unauthenticated attacker     can pre-create sessions leading to account takeover if a user logs in using the attacker's     session. (CVE-2026-7507)

  - A flaw was found in Keycloak's SAML endpoint processing. A crafted XML request to the SAML     endpoint can cause a denial of service by consuming excessive server resources. (CVE-2026-7307)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
458472	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.6.2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458472	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.6.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
442647	SCA: security update for org.keycloak:keycloak-services (GHSA-w4p5-rfh6-cwrv)	Tenable Cloud Security	SCA Checks	Local	medium
442647	SCA: security update for org.keycloak:keycloak-services (GHSA-w4p5-rfh6-cwrv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
316461	Keycloak < 26.6.2 Multiple Vulnerabilities	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-37982

medium

Tenable Plugins

medium

medium

medium

medium

medium