Keycloak WebAuthn Attestation Verification Bypass Vulnerability

A vulnerability exists in Keycloak's WebAuthn registration component, allowing attackers to bypass attestation policies and register untrusted or forged authenticators. This is achieved by submitting an attestation object with 'fmt: "none"', even when the realm requires direct attestation. The flaw can weaken authentication integrity and lead to unauthorized registration of authenticators.

Impact

Exploitation of this vulnerability can bypass attestation requirements, allowing the registration of authenticators that should be considered untrusted. This could undermine the integrity of the authentication process by enabling the use of forged or unauthorized authentication devices.

Reproduction

To reproduce this vulnerability, initiate WebAuthn registration with 'none' attestation allowed. When the registration page appears, change the attestation preference to 'direct'. Complete the registration process, which will be accepted despite not providing the required attestation. This behavior indicates the vulnerability, as Keycloak should have rejected the registration under the current attestation policy.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.4.4, which includes the fix for this vulnerability.