---
id: CVE-2026-37982
title: >-
  Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover
  via webauthn token replay
summary: >-
  A flaw was found in Keycloak. This authentication vulnerability allows a
  remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's
  WebAuthn (Web Authentication) flow. By intercepting an execute-actions email
  link, an…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-294
vendor: Red Hat
product: rhbk/keycloak-operator-bundle
affected:
  - rhbk/keycloak-operator-bundle (all versions)
  - rhbk/keycloak-rhel9 (all versions)
  - rhbk/keycloak-rhel9-operator (all versions)
  - rhbk/keycloak-rhel9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-19T13:37:29.663865Z'
published: '2026-05-19'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T09:29:09.736Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-37982'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:19596'
    label: 'RHSA-2026:19596'
  - url: 'https://access.redhat.com/errata/RHSA-2026:19597'
    label: 'RHSA-2026:19597'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-37982'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2455329'
    label: RHBZ#2455329
tags:
  - cve.org
epss: 0.0044
epssPercentile: 0.38256
ingestedAt: '2026-10-31T04:17:25.425Z'
---

## Overview

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

## Affected

- `rhbk/keycloak-operator-bundle (all versions)`
- `rhbk/keycloak-rhel9 (all versions)`
- `rhbk/keycloak-rhel9-operator (all versions)`
- `rhbk/keycloak-rhel9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, consider disabling WebAuthn required actions in Keycloak if they are not essential for your deployment. This will prevent the vulnerable token replay mechanism from being exploited. Consult Keycloak documentation for specific configuration steps to disable WebAuthn required actions. Note that applying configuration changes may require a service restart and could impact functionality relying on WebAuthn registration.