CVE-2026-37982

🔶 medium

Summary

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

CVSS Score

6.8

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-19

First Seen: 2026-05-20

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 48.9% of all 326,604 vulnerabilities in our database.

#167,034

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 19, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-06-03

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE IDs (Weakness Types)

CWE-294

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
redhat	build_of_keycloak	Affected	> 26.4 < 26.4.12

🔗 References 4

https://access.redhat.com/errata/RHSA-2026:19596

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:19597

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-37982

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2455329

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	Summary	Published
CVE-2026-9791	🔶 medium	4.3	A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by acces...	2026-05-28
CVE-2026-9792	🔶 medium	6.5	A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When cer...	2026-05-28
CVE-2026-9793	🔶 medium	5.9	A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incor...	2026-05-28
CVE-2026-9794	🔶 medium	5.3	A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially cra...	2026-05-28
CVE-2026-9795	⚠️ high	7.3	A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client man...	2026-05-28
CVE-2026-9796	🔶 medium	6.5	A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check ...	2026-05-28

These CVEs affect the same products