Описание
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ExecuteActionsActionToken tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
Отчет
This vulnerability has a Moderate impact on Red Hat Build of Keycloak (RHBK). A flaw in Keycloak's WebAuthn flow allows an attacker who gains access to an execute-actions email link to replay tokens containing WEBAUTHN_REGISTER or WEBAUTHN_PASSWORDLESS_REGISTER. This enables unauthorized WebAuthn registration with the attacker's authenticator on the victim's account, leading to account takeover. Exploitation requires WebAuthn required actions to be enabled and the email link to be compromised.
Меры по смягчению последствий
To mitigate this issue, consider disabling WebAuthn required actions in Keycloak if they are not essential for your deployment. This will prevent the vulnerable token replay mechanism from being exploited. Consult Keycloak documentation for specific configuration steps to disable WebAuthn required actions. Note that applying configuration changes may require a service restart and could impact functionality relying on WebAuthn registration.
Дополнительная информация
Статус:
6.8 Medium
CVSS3
Связанные уязвимости
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
A flaw was found in Keycloak. This authentication vulnerability allows ...
Keycloak: Unauthorized account takeover via WebAuthn token replay
6.8 Medium
CVSS3