5.4
Moyenne
CVE-2025-0604 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat build of Keycloak 26.0 26.0 | premières → < 26.0-12 | 26.0-12 |
| Red Hat Single Sign-On 7 | Versions non publiées |
Références
- RHSA-2025:2544 access.redhat.com
- RHSA-2025:2545 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2338993 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Build of Keycloak
Les 275 CVE de Red Hat Build of Keycloak →
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Moyenne
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Moyenne
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Moyenne
CVE-2026-96460
Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
5.4
Moyenne