CVE-2025-12150

low-risk
Published 2026-02-27

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.1/10 Low
NETWORK / HIGH complexity

Affected Products (3)

Affected Vendors

Redhat

References (7)

Vendor Advisory https://access.redhat.com/errata/RHSA-2025:21370
Vendor Advisory https://access.redhat.com/errata/RHSA-2025:21371
Vendor Advisory https://access.redhat.com/errata/RHSA-2025:22088
Vendor Advisory https://access.redhat.com/errata/RHSA-2025:22089
Vendor Advisory https://access.redhat.com/security/cve/CVE-2025-12150
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2406192
Issue Tracking https://github.com/keycloak/keycloak/issues/43723
20
/ 100
low-risk
Severity 11/34 · Low
Exploitability 0/34 · Minimal
Exposure 9/34 · Low