This vulnerability affects the Red Hat Build of Keycloak's WebAuthn authentication flow. It permits a remote attacker to replay ExecuteActionsActionToken tokens, which are used in the execute-actions email links. By doing so, the attacker can enroll their own hardware-backed authenticator to a victim's account, resulting in unauthorized persistent account takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts with no availability impact. Red Hat has published an advisory but has not yet provided a patch or official remediation instructions.

Successful exploitation allows an attacker to persistently take over a victim's account by enrolling a hardware-backed authenticator without authorization. This compromises account confidentiality and integrity but does not affect availability. The vulnerability requires the attacker to intercept an execute-actions email link and user interaction (clicking the link). There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-37982 for current remediation guidance. Until an official fix is released, organizations should consider restricting or monitoring the use of execute-actions email links and WebAuthn enrollment flows to mitigate risk. No vendor-provided mitigation or workaround is currently documented.