CVE-2026-8830 — Keycloak Vulnerability

title: CVE-2026-8830 - Keycloak WebAuthn Policy Bypass During Credential Registration
id: scw-2026-05-19-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation of CVE-2026-8830 in Keycloak. It specifically looks for POST requests to WebAuthn endpoints within Keycloak realms that include parameters indicative of credential registration. The vulnerability allows authenticated users to bypass WebAuthn policies by manipulating client-side JavaScript, leading to the registration of non-compliant credentials. This detection focuses on the web request pattern associated with the registration process which, if successful, would result in the creation of a credential not adhering to configured policies.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8830/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/realms/'
      cs-uri|endswith:
          - '/webauthn'
      cs-method:
          - 'POST'
      sc-status:
          - '200'
      cs-uri-query|contains:
          - 'credentialId'
      cs-uri-query|contains:
          - 'clientDataJSON'
      cs-uri-query|contains:
          - 'authenticatorData'
      cs-uri-query|contains:
          - 'clientExtensions'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse