CVE-2025-11538mediumCWE-1327

CVE-2025-11538: medium-severity vulnerability in keycloak

Keycloak-server: debug default bind address

Published · Updated

Follow this CVE+ Monitor Red Hat build of Keycloak+ Monitor keycloak

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.4%
In short

Keycloak's debug mode exposes a Java debugging port to the entire network by default, allowing attackers on the same network to remotely control the server and execute malicious code.

Technical detail

When debug mode is enabled via --debug flag, the JDWP port binds to 0.0.0.0 instead of localhost, exposing it to network-accessible attackers. An unauthenticated attacker with network access can attach a remote debugger to achieve arbitrary code execution within the Keycloak JVM without requiring valid credentials.

Summary generated and translated by AI from the official description.
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Keycloak · keycloakRed Hat · Red Hat build of Keycloak 26.4Red Hat · Red Hat build of Keycloak 26.4.4
Related CVEs — keycloak

In the same product, most dangerous first.

CVE-2026-18963CRITICALKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassEPSS 6.6%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.9%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.4%CVE-2026-93574MEDIUMIo.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingEPSS 1.7%CVE-2026-93558HIGHIo.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of serviceEPSS 1.2%CVE-2026-93579MEDIUMIo.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)EPSS 1.1%