CVE-2026-8830: 
Java vulnerability analysis and mitigation

CVE-2026-8830 is a WebAuthn policy bypass vulnerability in Keycloak (org.keycloak:keycloak-services) that allows authenticated users to register non-compliant credentials by manipulating client-side JavaScript during the WebAuthn credential registration flow. The flaw was reported on May 18, 2026, and publicly disclosed on May 19, 2026. It affects all versions of org.keycloak:keycloak-services up to and including 26.6.2, with version 26.6.3 containing the fix. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-603 (Use of Client-Side Authentication): the server-side processAction() method in Keycloak's WebAuthn registration flow does not validate that the newly created credential's parameters — such as public key algorithms, user verification settings, or resident key configuration — match the realm's configured WebAuthn policies. Because enforcement is performed only on the client side via JavaScript, an authenticated user can modify or intercept the client-side script to submit a credential registration request with parameters that violate administrative policy. The vulnerability requires network access and low-level authenticated privileges, but no user interaction beyond the attacker's own session (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows an authenticated user to register WebAuthn credentials that do not comply with the realm's administrative security policies, such as weaker public key algorithms or non-required user verification. This undermines the integrity of the authentication configuration enforced by administrators, potentially allowing the attacker to authenticate using a weaker credential type than intended. There is no direct confidentiality or availability impact, but the weakened authentication posture could facilitate further account compromise or policy circumvention (Red Hat CVE, GitHub Advisory).

1. Authenticate: Log in to a Keycloak instance as a regular authenticated user in a realm that has WebAuthn policies configured (e.g., requiring specific public key algorithms such as ES256).
2. Initiate WebAuthn credential registration: Navigate to the account console or trigger the WebAuthn credential registration flow (e.g., via the account security settings page).
3. Intercept or modify client-side JavaScript: Use browser developer tools or a proxy (e.g., Burp Suite) to modify the client-side JavaScript that constructs the PublicKeyCredentialCreationOptions object, changing parameters such as pubKeyCredParams to specify a weaker or non-policy-compliant algorithm.
4. Submit the modified registration request: Complete the WebAuthn registration flow with the tampered parameters. The browser generates a credential using the attacker-specified algorithm.
5. Bypass server-side validation: Because processAction() does not re-validate the credential parameters against the realm's WebAuthn policy, the server accepts and stores the non-compliant credential.
6. Authenticate with non-compliant credential: The attacker can now authenticate using the registered credential, which does not meet the realm's security requirements (Red Hat Bugzilla, GitHub Advisory).

• Logs: Keycloak audit/event logs showing WebAuthn credential registration events (REGISTER_WEBAUTHN_AUTHENTICATOR) for users where the registered credential's algorithm or attestation parameters differ from those mandated by the realm's WebAuthn policy.
• Logs: Unexpected or repeated WebAuthn registration attempts by the same user account in a short time window, potentially indicating trial-and-error manipulation.
• Network: HTTP requests to Keycloak's WebAuthn registration endpoint (e.g., /realms/{realm}/login-actions/authenticate) containing PublicKeyCredentialCreationOptions responses with algorithm identifiers not matching the configured policy (e.g., algorithm IDs other than those whitelisted by the realm).
• Application: Presence of registered WebAuthn credentials in the Keycloak database (WEBAUTHN_CREDENTIAL table) with aaguid, algorithm, or attestation values inconsistent with the realm's configured WebAuthn policy.

Upgrade org.keycloak:keycloak-services to version 26.6.3 or later, which includes the server-side validation fix for processAction() (GitHub Advisory, Keycloak Release). Red Hat has issued errata RHSA-2026:25097 and RHSA-2026:25098 for affected Red Hat build of Keycloak packages (Red Hat Errata 25097, Red Hat Errata 25098). No configuration-based workaround is available; patching is the only remediation. Administrators should also audit existing WebAuthn credentials post-upgrade to identify any non-compliant registrations that may have occurred prior to patching.

The vulnerability was covered in a weekly Keycloak security brief noting 16 CVEs addressed in the 26.6.3 release, with this issue highlighted as part of the EU public sector's reference IAM platform (CTI Pilot). Community reaction has been limited given the medium severity rating and the requirement for an authenticated attacker. No notable independent researcher commentary or significant social media discussion beyond automated CVE tracking posts has been observed.