SB2026091058 - Multiple vulnerabilities in Keycloak

Description

This security bulletin contains information about 3 vulnerabilities.

1) Incorrect authorization (CVE-ID: CVE-2025-14559)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to obtain access and refresh tokens for disabled users and use previously revoked privileges.

The vulnerability exists due to incorrect authorization in the Token Exchange implementation of the keycloak-services component when a privileged client invokes the token exchange flow. A remote privileged user can invoke the token exchange flow for a disabled user to obtain access and refresh tokens for that user and use previously revoked privileges.

2) CRLF injection (CVE-ID: CVE-2025-67735)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data in io.netty.handler.codec.http.HttpRequestEncoder. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

3) Resource management error (CVE-ID: CVE-2025-66560)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked.  A remote attacker can initiate multiple requests to the server and keep dropping the connections exhausting the available worker threads.

Remediation

Install update from vendor's website.

References

• https://github.com/advisories/GHSA-wv3h-x6c4-r867
• https://github.com/keycloak/keycloak/releases/tag/26.5.2
• https://github.com/keycloak/keycloak/commit/d67349f3aa9fed5c61750619d0f9de6356aeaeff