Is CVE-2026-8830 actively exploited?

No active exploitation of CVE-2026-8830 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-8830 be exploited remotely?

Yes. CVE-2026-8830 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-8830?

CVE-2026-8830 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-8830

MEDIUM

CVE-2026-8830

CWE-603Published: May 19, 2026· Updated: May 19, 2026

4.3

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.4th

Official Description

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.

NVD Source

Technical Analysis

CVE-2026-8830 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.