Vulnerability record · CVE-2025-12150 · published 27 February 2026

CVE-2025-12150: Redhat build of keycloak improper verification of cryptographic signature vulnerability

Redhat · Build Of Keycloak

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

3.1 CVSS 3.1 Low EPSS 0.21% · top 90.4% CWE-347 · Improper verification of cryptographic signature

3.1CVSS 3.1 base score

0.21%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

7References

10 Aug 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Build Of Keycloak Redhat

Keycloak Redhat

References

Link	Tags
https://access.redhat.com/errata/RHSA-2025:21370	Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:21371	Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:22088	Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:22089	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-12150	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2406192	Issue Tracking
https://github.com/keycloak/keycloak/issues/43723	Issue Tracking

Track CVE-2025-12150 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-16442Redhat build of keycloak origin validation error vulnerabilityA flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs beca…EPSS 0.31%5 Aug 2026 9.8CVE-2022-1245Redhat keycloak missing authorization vulnerabilityA privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid ac…EPSS 1.4%8 Jul 2022 9.8CVE-2019-14910Redhat keycloak improper authentication vulnerabilityA vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDA…EPSS 1.1%5 Dec 2019 9.6CVE-2021-20195Redhat keycloak improper input validation vulnerabilityA flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to …EPSS 1.2%28 May 2021 9.1CVE-2026-16443Redhat build of keycloak improper verification of cryptographic signature vulnerabilityA flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red…EPSS 0.26%5 Aug 2026 9.1CVE-2022-3782Redhat keycloak path traversal vulnerabilitykeycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An a…EPSS 5.8%13 Jan 2023 9.1CVE-2019-14837Redhat keycloak hard-coded credentials vulnerabilityA flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name …EPSS 1.7%7 Jan 2020 8.8CVE-2026-15572Redhat build of keycloak type confusion vulnerabilityA flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restri…EPSS 0.65%5 Aug 2026

Source: NIST National Vulnerability Database (record CVE-2025-12150), CISA KEV, FIRST EPSS (scores of 2026-10-09). This page is refreshed as NVD updates the record.