Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2025-11538 A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…

Description

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

Produits et versions touchés

Produit Versions touchées Corrigé en
keycloak 26.4 premières → < 26.4.4 26.4.4
Red Hat build of Keycloak 26.4 26.4 premières → < 26.4-3 26.4-3
Red Hat build of Keycloak 26.4.4 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de keycloak

Les 15 CVE de keycloak →
CVE-2026-90997 A flaw was found in Keycloak 7.4 Élevée CVE-2026-1609 A flaw was found in Keycloak 8.1 Élevée CVE-2025-12150 A flaw was found in Keycloak’s WebAuthn registration component 3.1 Faible CVE-2025-13467 A flaw was found in the Keycloak LDAP User Federation provider 5.5 Moyenne
Suivre cette CVE