Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2026-37982 is a medium-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30886
Vulnerability Data
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account.…
more
This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables replay of action tokens to register attacker-controlled WebAuthn credentials on victim accounts, directly mapping to Account Manipulation for persistent unauthorized access.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly governs binding and lifecycle of authenticators (WebAuthn), preventing unauthorized enrollment via replayed action tokens.
Requires cryptographic binding and freshness mechanisms that stop replay of ExecuteActionsActionToken values.
Forces fresh user re-authentication before sensitive operations such as adding a hardware authenticator.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic protections (e.g., nonces, timestamps, message authentication codes) make captured authentication messages unusable for replay.
Secure authentication mechanisms directly prevent replay attacks by requiring fresh, non-replayable credentials or tokens.
Network security controls such as encryption and integrity protection reduce the feasibility of capturing and replaying authentication traffic.
Application security requirements can mandate replay-resistant authentication designs, but the control itself does not prescribe the technical measures.