Input validation error in Keycloak - CVE-2025-9162
Published: September 9, 2025 / Updated: November 17, 2025
Vulnerability identifier: #VU115002
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-9162
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input within the keycloak-model-storage-service component. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. A remote privileged user can inject malicious content during the realm import procedure and gain access to sensitive information.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2025-9162
Install updates from vendor's website.
Keycloak - addressed in versions 26.0.15, 26.2.9, 26.3.4
Red Hat build of Keycloak - addressed in versions 26.0.15, 26.2.8
Red Hat build of Keycloak - addressed in versions 26.0.15, 26.2.8
External References
- https://bugzilla.redhat.com/show_bug.cgi?id=2389396
- https://github.com/keycloak/keycloak/blob/75afda410495a9576e00edc3277ab42ca155f806/model/storage-services/src/main/java/org/keycloak/exportimport/AbstractFileBasedImportProvider.java#L35
- https://github.com/advisories/GHSA-w2wj-hw98-233h
- https://github.com/keycloak/keycloak/security/advisories/GHSA-8hxp-qmph-w5gq
- https://github.com/advisories/GHSA-8hxp-qmph-w5gq