Red Hat Security Advisory

RHSA-2025:2545

Red Hat build of Keycloak 26.0.10 Update

Released 2025-03-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Build of Keycloak

Fixes 3 records

TI-2024-31454 CVE-2024-47072 · GHSA-hfq9-hggm-c56q

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

MEDIUM 43

XStream is a simple library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02001 Published 2024-11-07 Partial fix · 1.4.21 CWE-121

TI-2025-00506 CVE-2025-0604 · GHSA-2p82-5wwr-43cw

Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak

LOW 26

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00701 Published 2025-01-22 Partial fix · 26.0.10, 26.1.3 +3 CWE-287

TI-2025-01195 CVE-2025-1391 · GHSA-gvgg-2r3r-53x7

Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims

LOW 25

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00474 Published 2025-02-17 Fixed in 26.0.10, 26.0.10-3 +3 CWE-284