The vulnerability in Red Hat build of Keycloak 26.4 arises because the server-side processAction() function fails to verify that the parameters of newly created WebAuthn credentials, such as public key algorithms, conform to the realm's configured security policies. An authenticated user can exploit this by manipulating client-side JavaScript during credential registration to bypass these policies. This results in the creation of credentials that do not adhere to administrative security requirements, weakening the system's overall authentication security. The CVSS 3.1 base score is 4.3 (medium severity), reflecting limited impact on confidentiality and no impact on availability or confidentiality, but with integrity impact due to policy bypass. The vendor advisory indicates that new images for Red Hat build of Keycloak 26.6.3 are available, which include multiple security fixes including this issue, although no explicit patch for this CVE is detailed separately.

An authenticated user can bypass configured WebAuthn policies during credential registration, allowing the creation of credentials that do not meet administrative security requirements. This could weaken the authentication security by permitting non-compliant or potentially less secure authentication methods. There is no direct impact on confidentiality or availability reported. The integrity of the authentication process is affected due to policy bypass.

Red Hat has released updated images for Red Hat build of Keycloak 26.6.3 that address this and other security issues. Users should upgrade to Red Hat build of Keycloak 26.6.3 or later to remediate this vulnerability. Before applying the update, back up existing installations, including applications, configuration files, and databases. Patch status is confirmed by the vendor advisory indicating availability of fixed images. No additional mitigations or workarounds are specified in the advisory.