Description
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | 25.0.0 – < 25.*, 26.0.0 – < 26.0.11, 26.2.0 – < 26.2.2 | 25.* |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat build of Keycloak 26 | — | — |
| Red Hat | Red Hat build of Keycloak 26.0 | — | — |
| Red Hat | Red Hat build of Keycloak 26.2 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | < 26.2.2 | 26.2.2 | GHSA-hw58-3793-42gg |
Advisories 2
- WID-SEC-2025-0908 Keycloack: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 29, 2025
- NCSC-2025-0141 Kwetsbaarheden verholpen in Keycloak NCSC-NL (Netherlands) · May 6, 2025
References
- RHSA-2025:4335 vendor-advisory
- RHSA-2025:4336 vendor-advisory
- RHSA-2025:8672 vendor-advisory
- RHSA-2025:8690 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-3501 vdb-entry
- RHBZ#2358834 issue-tracking
- https://github.com/keycloak/keycloak/issues/39350
- https://github.com/keycloak/keycloak/pull/39366