CVE-2026-37982: Keycloak Auth Bypass Vulnerability

CVE-2026-37982 Overview

CVE-2026-37982 is an authentication flaw in Keycloak that allows remote attackers to replay ExecuteActionsActionToken tokens within the WebAuthn (Web Authentication) flow. An attacker who intercepts an execute-actions email link can register their own authenticator against a victim's account. Successful exploitation results in unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover. The weakness is tracked under CWE-294: Authentication Bypass by Capture-replay. Red Hat published advisories RHSA-2026:19596 and RHSA-2026:19597 to address the issue.

Critical Impact
An attacker who replays an ExecuteActionsActionToken can bind their own WebAuthn authenticator to a victim's Keycloak account, granting persistent, hardware-backed access.

Affected Products

Red Hat build of Keycloak (see RHSA-2026:19596)
Red Hat Single Sign-On / Keycloak distributions referenced in RHSA-2026:19597
Upstream Keycloak deployments using WebAuthn with ExecuteActionsActionToken

Discovery Timeline

2026-05-19 - CVE-2026-37982 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-37982

Vulnerability Analysis

Keycloak issues ExecuteActionsActionToken values to drive required user actions, such as registering a WebAuthn authenticator, through an emailed link. The flow does not adequately bind the token to a single use or to the authenticating party. An attacker who intercepts the email link can replay the same token against the WebAuthn registration endpoint. The server then enrolls the attacker's authenticator on the victim's account.

Because WebAuthn credentials are treated as strong, hardware-backed factors, the rogue authenticator persists across password resets and standard session revocations. The attacker can authenticate as the victim and bypass downstream multi-factor enforcement that relies on WebAuthn. Exploitation requires user interaction with the original email and an opportunity to capture the link in transit or at rest.

Root Cause

The root cause is insufficient replay protection on ExecuteActionsActionToken within the WebAuthn registration code path. The token is not strictly invalidated after first use or bound to the originating browser session, which permits capture-replay attacks classified under CWE-294.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must obtain the execute-actions URL, for example through a compromised mailbox, mail relay, logging system, or referer leak. The attacker then submits the token to the Keycloak WebAuthn registration endpoint and completes attestation with an authenticator under their control. No exploit code is publicly available, and the vulnerability is not listed in the CISA KEV catalog.

No verified proof-of-concept code is published. See the Red Hat CVE Analysis for CVE-2026-37982 and Red Hat Bug Report #2455329 for additional technical context.

Detection Methods for CVE-2026-37982

Indicators of Compromise

WebAuthn credential registrations on user accounts that do not correlate with user-initiated activity in Keycloak event logs.
Multiple uses or reuse attempts of the same ExecuteActionsActionToken value recorded in Keycloak audit events.
Successful EXECUTE_ACTIONS or UPDATE_CREDENTIAL events originating from IP addresses or user agents that differ from the recipient of the email link.

Detection Strategies

Enable Keycloak event logging and forward EXECUTE_ACTIONS, UPDATE_CREDENTIAL, and REGISTER events to a centralized SIEM for correlation.
Alert on enrollment of new WebAuthn authenticators followed by authentication from a previously unseen device fingerprint.
Correlate execute-actions email delivery timestamps with token redemption timestamps to identify out-of-band redemptions.

Monitoring Recommendations

Monitor reverse proxy and mail gateway logs for unauthorized access to mailboxes that receive Keycloak action emails.
Track per-user counts of registered WebAuthn credentials and alert on additions outside change windows.
Review Keycloak admin events for changes to authentication flows or required actions that could be abused alongside this flaw.

How to Mitigate CVE-2026-37982

Immediate Actions Required

Apply the fixed Keycloak packages referenced in RHSA-2026:19596 and RHSA-2026:19597.
Audit all WebAuthn credentials enrolled since the affected versions were deployed and remove any that cannot be attributed to legitimate users.
Invalidate outstanding ExecuteActionsActionToken values by rotating Keycloak realm signing keys.

Patch Information

Red Hat addresses CVE-2026-37982 in the Keycloak packages distributed through RHSA-2026:19596 and RHSA-2026:19597. Refer to the Red Hat CVE Analysis for CVE-2026-37982 for the authoritative list of fixed component versions and to Red Hat Bug Report #2455329 for upstream tracking.

Workarounds

Reduce the lifetime of execute-actions tokens in the realm token settings to limit the replay window until patches are applied.
Restrict who can trigger executeActions emails to administrators only, and require administrator review of WebAuthn enrollments.
Enforce TLS and mailbox protections to prevent interception of action URLs in transit and at rest.

bash

# Configuration example: shorten action token lifespan via kcadm
kcadm.sh update realms/<realm> \
  -s 'actionTokenGeneratedByUserLifespan=300' \
  -s 'actionTokenGeneratedByAdminLifespan=300'