CVE-2025-12150

Katalog CVE

CVSS 3.1 · Low EPSS 0,21%

Kerentanan Improper Verification of Cryptographic Signature pada redhat build of keycloak, redhat keycloak. Skor CVSS 3.1 3.1 (Low) menurut NVD.

Deskripsi (NVD)

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

10 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2025:21370 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:21371 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:22088 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:22089 advisory vendor
• https://access.redhat.com/security/cve/CVE-2025-12150 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2406192 issue tracking
• https://github.com/keycloak/keycloak/issues/43723 issue tracking