Aller au contenu
en Se connecter
7.1 Élevée

CVE-2025-7365 A flaw was found in Keycloak

Description

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat build of Keycloak 26 Versions non publiées
Red Hat build of Keycloak 26.0 26.0 premières → < 26.0-17 26.0-17
Red Hat build of Keycloak 26.2 26.2 premières → < 26.2-6 26.2-6

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat build of Keycloak 26

Les 3 CVE de Red Hat build of Keycloak 26 →
CVE-2025-7784 A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are… 6.5 Moyenne CVE-2025-3501 A flaw was found in Keycloak 8.2 Élevée
Suivre cette CVE