Keycloak WebAuthn Policy Bypass Vulnerability

A vulnerability in Keycloak allows authenticated users to bypass WebAuthn policies during credential registration. This issue arises because the server-side processAction() does not properly validate that the parameters of newly created credentials, such as public key algorithms, align with the realm's WebAuthn policy settings. As a result, credentials that fail to meet security requirements can be registered, potentially undermining the system's overall security by permitting non-compliant authentication methods.

Impact

Exploiting this vulnerability could lead to the registration of WebAuthn credentials that do not comply with established security policies, allowing weaker authentication methods to be used.