The vulnerability in Red Hat build of Keycloak 26.4 involves replaying ExecuteActionsActionToken tokens in the WebAuthn authentication flow. An attacker who intercepts an execute-actions email link can exploit this flaw to enroll a hardware-backed credential to a victim's account without authorization, resulting in persistent account takeover. This issue is tracked as CVE-2026-37982 with a CVSS 3.1 base score of 6.8, indicating medium severity. Red Hat has published security advisories and released version 26.4.12 of Keycloak with fixes for this and other vulnerabilities. The advisories recommend backing up existing installations before applying the update.

Successful exploitation allows an attacker to perform unauthorized enrollment of hardware-backed authenticators to victim accounts, leading to persistent account takeover. This compromises the confidentiality and integrity of user accounts within Keycloak authentication systems. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Red Hat has released an official security update in Keycloak version 26.4.12 that addresses this vulnerability along with others. Users should back up their existing Keycloak installations, including applications, configuration files, and databases, before applying the update. Applying the update will remediate this vulnerability. No alternative mitigations or workarounds are indicated in the vendor advisory.