Search: CVE-2025-12150

A vulnerability in Keycloak's WebAuthn registration component allows bypassing the configured attestation policy by submitting an attestation object with fmt: "none". This occurs even when the realm requires direct attestation, potentially enabling registration of untrusted or forged authenticators. The issue affects Keycloak versions prior to 26.4.4. A security update is available from Red Hat to address this flaw.