CVE-2026-37982

MediumCVSS 6.8/10Last modified Oct 29, 2026

Description

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-294

Affected software

VendorProductVersions
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4.12—

References

Timeline

Published
May 19, 2026
Last modified
Oct 29, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-37998.8A flaw has been found in Tenda i3 1.0.0.6(2204). This impacts the function formSetCfm of the file /goform/setcfm. This manipulation of the aCVE-2026-38008.8A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /controCVE-2026-38018.8A vulnerability was found in Tenda i3 1.0.0.6(2204). Affected by this vulnerability is the function formSetAutoPing of the file /goform/setACVE-2026-38028.8A vulnerability was determined in Tenda i3 1.0.0.6(2204). Affected by this issue is the function formexeCommand of the file /goform/exeCommaCVE-2026-38038.8A vulnerability was identified in Tenda i3 1.0.0.6(2204). This affects the function formWifiMacFilterGet of the file /goform/WifiMacFilterGeCVE-2026-38048.8A security flaw has been discovered in Tenda i3 1.0.0.6(2204). This vulnerability affects the function formWifiMacFilterSet of the file /gofCVE-2026-38057.5When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.CVE-2026-380568.8A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satCVE-2026-380578.1The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST CVE-2026-380588.1The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contCVE-2026-380597.5The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network acCVE-2026-38068.8A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the fil