Org.keycloak/keycloak-services: webauthn attestation statement verification bypass (CVE-2025-12150)

CVE-2025-12150 is a vulnerability in Keycloak's WebAuthn registration component that permits an attacker to bypass the attestation policy configured for the realm. Specifically, by submitting an attestation object with the format "none", an attacker can register authenticators that are untrusted or forged, even if the realm is set to require direct attestation. This weakens authentication integrity by allowing unauthorized authenticators to be registered. The flaw affects Keycloak versions before 26.4.4. Red Hat has released security updates (Keycloak 26.4.4) that fix this issue.

The vulnerability undermines the integrity of WebAuthn authentication by allowing attackers to register untrusted or forged authenticators despite policy settings requiring direct attestation. This could lead to weakened authentication controls and unauthorized access through compromised or fake authenticators. However, the severity is rated as low by the vendor.

A security update is available and should be applied to Keycloak version 26.4.4 or later. Red Hat has published advisories and errata with updated packages and container images that fix this vulnerability. Users should back up their installations and apply the official patches as provided in the Red Hat advisories RHSA-2025:21370 and RHSA-2025:21371. No other specific mitigations are indicated by the vendor.