5.5
Moyenne
CVE-2025-13467 A flaw was found in the Keycloak LDAP User Federation provider
Description
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| keycloak 26.4 | premières → < 26.4.6 | 26.4.6 |
| Red Hat build of Keycloak 26.2 26.2 | premières → < 26.2-12 | 26.2-12 |
| Red Hat build of Keycloak 26.2.11 | Versions non publiées | |
| Red Hat build of Keycloak 26.4 26.4 | premières → < 26.4-5 | 26.4-5 |
| Red Hat build of Keycloak 26.4.6 | Versions non publiées |
Références
- RHSA-2025:22088 access.redhat.com
- RHSA-2025:22089 access.redhat.com
- RHSA-2025:22090 access.redhat.com
- RHSA-2025:22091 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2416038 bugzilla.redhat.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de keycloak
Les 15 CVE de keycloak →
CVE-2026-90997
A flaw was found in Keycloak
7.4
Élevée
CVE-2026-1609
A flaw was found in Keycloak
8.1
Élevée
CVE-2025-12150
A flaw was found in Keycloak’s WebAuthn registration component
3.1
Faible
CVE-2025-11538
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…
6.8
Moyenne