CVE-2025-3501highCWE-297

CVE-2025-3501: high-severity vulnerability in keycloak

Org.keycloak.protocol.services: keycloak hostname verification

Published · Updated

Follow this CVE+ Monitor Red Hat build of Keycloak+ Monitor Red Hat Single Sign-On

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.5%
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected products
keycloakRed Hat · Red Hat Build of KeycloakRed Hat · Red Hat build of Keycloak 26Red Hat · Red Hat build of Keycloak 26.0Red Hat · Red Hat build of Keycloak 26.2Red Hat · Red Hat Single Sign-On 7
Related CVEs — keycloak

In the same product, most dangerous first.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2023-5685HIGHXnio: stackoverflowexception when the chain of notifier states becomes problematically bigEPSS 3.5%CVE-2024-3656HIGHKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesEPSS 3.3%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%CVE-2024-8883MEDIUMKeycloak: vulnerable redirect uri validation results in open redirecEPSS 2.1%