Design/Logic Flaw

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow...

PT-2021-3507 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: The issue is related to weaknesses in the WebAuthn authentication mechanism. It allows an attacker to register a new security device or key for any user without a previously registered...