Description
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Keycloak | Keycloak | < 26.4.6 | 26.4.6 |
| Red Hat | Red Hat build of Keycloak 26.2 | — | — |
| Red Hat | Red Hat build of Keycloak 26.2.11 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.6 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-ldap-federation | >= 26.3.0, < 26.4.6 | 26.4.6 | GHSA-4hx9-48xh-5mxr |
| Maven | org.keycloak:keycloak-ldap-federation | < 26.2.11 | 26.2.11 | GHSA-4hx9-48xh-5mxr |
Advisories 1
- WID-SEC-2025-2650 Keycloak: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · May 27, 2026
References
- RHSA-2025:22088 vendor-advisory
- RHSA-2025:22089 vendor-advisory
- RHSA-2025:22090 vendor-advisory
- RHSA-2025:22091 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-13467 vdb-entry
- RHBZ#2416038 issue-tracking
- https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328
- https://github.com/keycloak/keycloak/issues/44478