CVE-2026-8830

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.

• CWE-603

• https://access.redhat.com/errata/RHSA-2026:25097
• https://access.redhat.com/errata/RHSA-2026:25098
• https://access.redhat.com/errata/RHSA-2026:30049
• https://access.redhat.com/errata/RHSA-2026:30050
• https://access.redhat.com/security/cve/CVE-2026-8830Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2479565Issue Tracking, Vendor Advisory

Published

May 19, 2026

Last Modified

Jul 23, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8814Versions of the package exifreader before 4.39.0 are vulnera…5.5
• CVE-2026-8823Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fa…3.8
• CVE-2026-8825The Elementor Website Builder WordPress plugin before 4.1.4…4.9
• CVE-2026-8827The AddressRepository::getSqlQuery() method constructs a dat…8.2
• CVE-2026-8828A lack of authorization validation in version 1.0.0 or later…8.8
• CVE-2026-8829HTML::Entities versions before 3.84 for Perl read freed heap…7.5
• CVE-2026-8832The WPCode - Insert Headers and Footers + Custom Code Snippe…8.8
• CVE-2026-8833Improper neutralization of HTML-encoded characters in the UR…5.4
• CVE-2026-8834IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vuln…8
• CVE-2026-8835IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointe…7.3
• CVE-2026-8836A vulnerability was found in lwIP up to 2.2.1. Affected is t…9.8
• CVE-2026-8837The WP Iframe Geo Style for Amazon affiliates plugin for Wor…6.4