CVE-2026-37982

MediumCVSS 6.8/10Last modified Oct 29, 2026

Description

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4.12	—

References

https://access.redhat.com/errata/RHSA-2026:19596Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19597Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-37982Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2455329Vendor Advisory

Timeline

Published: May 19, 2026
Last modified: Oct 29, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-37998.8A flaw has been found in Tenda i3 1.0.0.6(2204). This impacts the function formSetCfm of the file /goform/setcfm. This manipulation of the a CVE-2026-38008.8A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /contro CVE-2026-38018.8A vulnerability was found in Tenda i3 1.0.0.6(2204). Affected by this vulnerability is the function formSetAutoPing of the file /goform/setA CVE-2026-38028.8A vulnerability was determined in Tenda i3 1.0.0.6(2204). Affected by this issue is the function formexeCommand of the file /goform/exeComma CVE-2026-38038.8A vulnerability was identified in Tenda i3 1.0.0.6(2204). This affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGe CVE-2026-38048.8A security flaw has been discovered in Tenda i3 1.0.0.6(2204). This vulnerability affects the function formWifiMacFilterSet of the file /gof CVE-2026-38057.5When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.CVE-2026-380568.8A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount sat CVE-2026-380578.1The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST CVE-2026-380588.1The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which cont CVE-2026-380597.5The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network ac CVE-2026-38068.8A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the fil