Skip to content
fr Sign in
6.8 Medium

CVE-2025-11538 A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…

Description

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

Affected products and versions

Product Affected versions Fixed in
keycloak 26.4 earliest → < 26.4.4 26.4.4
Red Hat build of Keycloak 26.4 26.4 earliest → < 26.4-3 26.4-3
Red Hat build of Keycloak 26.4.4 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of keycloak

The 15 CVEs of keycloak →
CVE-2026-90997 A flaw was found in Keycloak 7.4 High CVE-2026-1609 A flaw was found in Keycloak 8.1 High CVE-2025-12150 A flaw was found in Keycloak’s WebAuthn registration component 3.1 Low CVE-2025-13467 A flaw was found in the Keycloak LDAP User Federation provider 5.5 Medium
Track this CVE