5.5
Medium
CVE-2025-13467 A flaw was found in the Keycloak LDAP User Federation provider
Description
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak 26.4 | earliest → < 26.4.6 | 26.4.6 |
| Red Hat build of Keycloak 26.2 26.2 | earliest → < 26.2-12 | 26.2-12 |
| Red Hat build of Keycloak 26.2.11 | Versions not published | |
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-5 | 26.4-5 |
| Red Hat build of Keycloak 26.4.6 | Versions not published |
References
- RHSA-2025:22088 access.redhat.com
- RHSA-2025:22089 access.redhat.com
- RHSA-2025:22090 access.redhat.com
- RHSA-2025:22091 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2416038 bugzilla.redhat.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of keycloak
The 15 CVEs of keycloak →
CVE-2026-90997
A flaw was found in Keycloak
7.4
High
CVE-2026-1609
A flaw was found in Keycloak
8.1
High
CVE-2025-12150
A flaw was found in Keycloak’s WebAuthn registration component
3.1
Low
CVE-2025-11538
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…
6.8
Medium