This vulnerability arises because the server-side processAction() function in Red Hat Build of Keycloak fails to validate that newly created WebAuthn credential parameters, such as public key algorithms, conform to the realm's configured policies. An authenticated user can exploit this by manipulating client-side JavaScript during credential registration to bypass these policies. Consequently, credentials that do not adhere to administrative security requirements may be created, potentially weakening the system's overall security. The issue is tracked as CVE-2026-8830 with a CVSS 3.1 base score of 4.3 (medium severity). No patch or official fix has been documented in the vendor advisory as of the published date.

The impact is limited to the integrity of WebAuthn credential registration in Red Hat Build of Keycloak. An authenticated user can register credentials that bypass configured security policies, potentially allowing weaker or non-compliant authentication methods. This could reduce the effectiveness of administrative security controls but does not directly impact confidentiality or availability. There are no known exploits in the wild reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-8830 for current remediation guidance. Until an official fix is available, administrators should be aware of this limitation in WebAuthn policy enforcement and consider additional compensating controls if feasible. No vendor advisory states that no action is required or that the issue is already mitigated.