CVE-2021-3632: Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow

The vulnerability arises because the WebAuthnPasswordlessAuthenticatorFactory in Keycloak versions <15.1.0 did not override the isUserSetupAllowed method inherited from its parent class (likely WebAuthnAuthenticatorFactory). This parent method allowed user setup (device registration) during authentication by default. Attackers exploited this by triggering the passwordless login flow for users without registered devices, forcing the registration of a new device and hijacking the account. The fix explicitly overrides isUserSetupAllowed in WebAuthnPasswordlessAuthenticatorFactory to return false, blocking this vector. The vulnerable function is the parent class's isUserSetupAllowed, which remained active in the absence of the override.