SB2025031143 - Multiple vulnerabilities in Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025031143

SB2025031143 - Multiple vulnerabilities in Keycloak

Published: March 11, 2025 Updated: September 10, 2026

Security Bulletin ID SB2025031143
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2025-1391)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper mapping of users to organizations based solely on email/username patterns. A remote attacker can trick an organization administrator into allowing user access based on naming pattern if, for example, self-registration is enabled and unrestricted.


2) Improper authentication (CVE-ID: CVE-2025-0604)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass authentication process.

The vulnerability exists due to Keycloak does not perform an LDAP bind after a password reset. A remote user can bypass authentication process for expired or disabled AD accounts gain unauthorized access to the application.


3) Comparison using wrong factors (CVE-ID: CVE-2026-9800)

CWE-ID: CWE-1025 - Comparison using wrong factors

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass authorization policies and gain unauthorized access to protected resources.

The vulnerability exists due to comparison using wrong factors in the Keycloak Policy Enforcer when handling request URLs containing the configured access-denied page path. A remote user can include the configured access-denied page path in a request URL as a path segment or query parameter to bypass authorization policies and gain unauthorized access to protected resources.

This can bypass role, scope, and User-Managed Access (UMA) permission checks.


4) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2025-0736)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores database credentials into log files when using JGroups with JDBC_PING. A local user can read the log files and gain access to sensitive data.


5) Buffer overflow (CVE-ID: CVE-2024-47072)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing unstrusted input. A remote attacker can pass a specially crafted stream to the application, trigger a stack overflow and perform a denial of service (DoS) attack.

Successful exploitation of this vulnerability requires that XStream is configured to use the BinaryStreamDriver.


6) Input validation error (CVE-ID: CVE-2024-12397)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of cookies with certain value-delimiting characters in incoming requests in Quarkus-HTTP. A remote attacker can construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification.


Remediation

Install update from vendor's website.

References