4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8830

CVE-2026-8830: Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8830

CVE-2026-8830:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	<= 26.6.2	26.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a policy bypass in Keycloak's WebAuthn registration process. The root cause is insufficient server-side validation within the org.keycloak.authentication.requiredactions.WebAuthnRegister.processAction method. An authenticated user could manipulate client-side JavaScript to send registration parameters that do not align with the realm's configured WebAuthn policies, and the server would incorrectly accept them.

The analysis of the patch commits reveals the exact location of the vulnerability. The primary fix is in the WebAuthnRegister.java file. The processAction method was modified to enforce the configured policies. Before the patch, the validation was incomplete. The patch introduces two main changes:

The RegistrationParameters passed to the underlying webauthn4j library now include the expected signature algorithms derived from the realm's policy. This is handled by the new buildExpectedCredentialParameters method. This ensures the library validates the algorithm used.
A new inner class, PolicyVerifier, was added to perform additional server-side checks that are not covered by the webauthn4j library's validation. This includes verifying the authenticatorAttachment and acceptableAaguids. The processAction method is updated to call PolicyVerifier.verifyCompliance.

By observing the code that was added to fix the vulnerability, we can identify that the processAction method was the point where the flawed logic existed. During exploitation, this function would be in the stack trace as it processes the malicious registration request.

Vulnerable functions

org.keycloak.authentication.requiredactions.WebAuthnRegister.processAction

services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java

This function is responsible for processing WebAuthn credential registration. The vulnerability lies in the fact that this function did not properly validate the incoming registration data against the configured WebAuthn policies of the realm. Specifically, it failed to check parameters like the public key algorithm and authenticator attachment. This allowed a malicious user to manipulate client-side data to register a credential that does not comply with the security policies, leading to a bypass of security controls.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.