CVE-2026-8830

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.

• CWE-603

• https://access.redhat.com/errata/RHSA-2026:25097
• https://access.redhat.com/errata/RHSA-2026:25098
• https://access.redhat.com/errata/RHSA-2026:30049
• https://access.redhat.com/errata/RHSA-2026:30050
• https://access.redhat.com/security/cve/CVE-2026-8830Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2479565Issue Tracking, Vendor Advisory

Published

May 19, 2026

Last Modified

Jul 23, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88286GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection…7.5
• CVE-2026-88287GeoVision GV-LPC2211 V1.13 fails to bound the number of Scop…7.5
• CVE-2026-88288GeoVision GV-LPC2211 V1.13 fails to restrict the filename su…6.5
• CVE-2026-88289GeoVision GV-LPC2211 V1.14 (260903) fails to validate attack…7.5
• CVE-2026-8829HTML::Entities versions before 3.84 for Perl read freed heap…7.5
• CVE-2026-88290GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated c…7.5
• CVE-2026-8832The WPCode - Insert Headers and Footers + Custom Code Snippe…8.8
• CVE-2026-8833Improper neutralization of HTML-encoded characters in the UR…5.4
• CVE-2026-88339A NULL pointer dereference vulnerability exists in the gf_sg…5.5
• CVE-2026-8834IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vuln…8
• CVE-2026-88340An invalid pointer release vulnerability exists in YARA 4.5.…
• CVE-2026-88341A reachable assertion vulnerability exists in YARA 4.5.8 whe…5.5