Description
A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | 25.0.0 – < 25.*, 26.0.0 – < 26.0.11, 26.2.0 – < 26.2.2 | 25.* |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat build of Keycloak 26.0 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | < 26.2.2 | 26.2.2 | GHSA-5jfq-x6xp-7rw2 |
Advisories 2
- WID-SEC-2025-0908 Keycloack: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 29, 2025
- NCSC-2025-0141 Kwetsbaarheden verholpen in Keycloak NCSC-NL (Netherlands) · May 6, 2025
References
- RHSA-2025:4335 vendor-advisory
- RHSA-2025:4336 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-3910 vdb-entry
- RHBZ#2361923 issue-tracking
- https://github.com/keycloak/keycloak/issues/39349