Keycloack: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 2

• High 8.2
  CVE-2025-3501

  Org.keycloak.protocol.services: keycloak hostname verification

  A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.

  Red Hat Red Hat Single Sign-On 7 Red Hat Build of Keycloak Red Hat build of Keycloak 26.2 Maven
  Apr 29, 2025
• Medium 5.4
  CVE-2025-3910

  Org.keycloak.authentication: two factor authentication bypass

  A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.

  Red Hat Red Hat Build of Keycloak Red Hat build of Keycloak 26.0 org.keycloak:keycloak-services Maven
  Apr 29, 2025

Revision history

1. 2025-09-29 #3

   Neue Updates von HITACHI aufgenommen

2. 2025-06-09 #2

   Neue Updates von Red Hat aufgenommen

3. 2025-04-29 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2025-04-29
  https://github.com/advisories/GHSA-r934-w73g-v4p8
• GitHub Advisory Database vom 2025-04-29
  https://github.com/advisories/GHSA-fx44-2wx5-5fvp
• RedHat Security Advisory vom 2025-04-29
  https://access.redhat.com/errata/RHSA-2025:4335
• RedHat Security Advisory vom 2025-04-29
  https://access.redhat.com/errata/RHSA-2025:4336
• Keycloak 26.2.2 released
  https://www.keycloak.org/2025/04/keycloak-2622-released
• Red Hat Security Advisory RHSA-2025:8672 vom 2025-06-09
  https://access.redhat.com/errata/RHSA-2025:8672
• Hitachi Vulnerability Information HITACHI-SEC-2025-127 vom 2025-09-30
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-127/index.html