rhsa-2025:2544
Vulnerability from csaf_redhat
Published
2025-03-10 18:17
Modified
2025-03-15 09:19
Summary
Red Hat Security Advisory: Red Hat build of Keycloak 26.0.10 Images Update

Notes

Topic
New images are available for Red Hat build of Keycloak 26.0.10 and Red Hat build of Keycloak 26.0.10 Operator, running on OpenShift Container Platform
Details
Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.0.10 clusters. This erratum releases new images for Red Hat build of Keycloak 26.0.10 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: * Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak (CVE-2025-0604) * Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims (CVE-2025-1391)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "New images are available for Red Hat build of Keycloak 26.0.10 and Red Hat build of Keycloak 26.0.10 Operator, running on OpenShift Container Platform",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services.\nRed Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.0.10 clusters.\nThis erratum releases new images for Red Hat build of Keycloak 26.0.10 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak (CVE-2025-0604)\n* Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims (CVE-2025-1391)",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2025:2544",
            url: "https://access.redhat.com/errata/RHSA-2025:2544",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "2338993",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2338993",
         },
         {
            category: "external",
            summary: "2346082",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2346082",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2544.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat build of Keycloak 26.0.10 Images Update",
      tracking: {
         current_release_date: "2025-03-15T09:19:22+00:00",
         generator: {
            date: "2025-03-15T09:19:22+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.1",
            },
         },
         id: "RHSA-2025:2544",
         initial_release_date: "2025-03-10T18:17:05+00:00",
         revision_history: [
            {
               date: "2025-03-10T18:17:05+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2025-03-10T18:17:05+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-03-15T09:19:22+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat build of Keycloak 26.0",
                        product: {
                           name: "Red Hat build of Keycloak 26.0",
                           product_id: "9Base-RHBK-26.0",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:build_keycloak:26.0::el9",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat build of Keycloak",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
                        product: {
                           name: "rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
                           product_id: "rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
                           product_identification_helper: {
                              purl: "pkg:oci/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca?arch=ppc64le&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.0-1741630390",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
                        product: {
                           name: "rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
                           product_id: "rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
                           product_identification_helper: {
                              purl: "pkg:oci/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b?arch=ppc64le&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.0-1741630464",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
                        product: {
                           name: "rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
                           product_id: "rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
                           product_identification_helper: {
                              purl: "pkg:oci/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657?arch=s390x&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.0-1741630390",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
                        product: {
                           name: "rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
                           product_id: "rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
                           product_identification_helper: {
                              purl: "pkg:oci/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444?arch=s390x&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.0-1741630464",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
                        product: {
                           name: "rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
                           product_id: "rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
                           product_identification_helper: {
                              purl: "pkg:oci/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.0-1741630390",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
                        product: {
                           name: "rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
                           product_id: "rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
                           product_identification_helper: {
                              purl: "pkg:oci/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle&tag=26.0.10-3",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
                        product: {
                           name: "rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
                           product_id: "rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
                           product_identification_helper: {
                              purl: "pkg:oci/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.0-1741630464",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "amd64",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64 as a component of Red Hat build of Keycloak 26.0",
               product_id: "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
            },
            product_reference: "rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
            relates_to_product_reference: "9Base-RHBK-26.0",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le as a component of Red Hat build of Keycloak 26.0",
               product_id: "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
            },
            product_reference: "rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
            relates_to_product_reference: "9Base-RHBK-26.0",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64 as a component of Red Hat build of Keycloak 26.0",
               product_id: "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
            },
            product_reference: "rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
            relates_to_product_reference: "9Base-RHBK-26.0",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x as a component of Red Hat build of Keycloak 26.0",
               product_id: "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
            },
            product_reference: "rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
            relates_to_product_reference: "9Base-RHBK-26.0",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le as a component of Red Hat build of Keycloak 26.0",
               product_id: "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
            },
            product_reference: "rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
            relates_to_product_reference: "9Base-RHBK-26.0",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64 as a component of Red Hat build of Keycloak 26.0",
               product_id: "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
            },
            product_reference: "rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
            relates_to_product_reference: "9Base-RHBK-26.0",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x as a component of Red Hat build of Keycloak 26.0",
               product_id: "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
            },
            product_reference: "rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
            relates_to_product_reference: "9Base-RHBK-26.0",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Dwayne Du",
               ],
            },
         ],
         cve: "CVE-2025-0604",
         cwe: {
            id: "CWE-287",
            name: "Improper Authentication",
         },
         discovery_date: "2025-01-20T11:30:22.389000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2338993",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak-ldap-federation: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2025-0604",
            },
            {
               category: "external",
               summary: "RHBZ#2338993",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2338993",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2025-0604",
               url: "https://www.cve.org/CVERecord?id=CVE-2025-0604",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2025-0604",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2025-0604",
            },
         ],
         release_date: "2025-01-20T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-10T18:17:05+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2544",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak-ldap-federation: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak",
      },
      {
         cve: "CVE-2025-1391",
         cwe: {
            id: "CWE-284",
            name: "Improper Access Control",
         },
         discovery_date: "2025-02-17T07:46:40.184000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2346082",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "keycloak-services: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
               "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2025-1391",
            },
            {
               category: "external",
               summary: "RHBZ#2346082",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2346082",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2025-1391",
               url: "https://www.cve.org/CVERecord?id=CVE-2025-1391",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2025-1391",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2025-1391",
            },
         ],
         release_date: "2025-02-17T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-10T18:17:05+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2544",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "9Base-RHBK-26.0:rhbk/keycloak-operator-bundle@sha256:d719dbf646d4c66e9fce35418a90bffc6ae4f40bdf7d7c306fb903f6f1bce14f_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:2cf74d2886063637b9c0bf1fe5d97866b8dcac8aa5c00b064790b8133fef676b_ppc64le",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:73097189922c29afdbb6890ebc2b3e276ab6fbfe81bc0d74d0c5268783c1e806_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9-operator@sha256:ed9cad42ed11212bf7a8dc7d6afbcc52cd76082f87fae5c0f923dcc70fc1a444_s390x",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:2cb3de99006ef0d9cf53955880c6eff3dbe5de5e7f9e6ddbb5e5b0bb828789ca_ppc64le",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:42cf4d4f9576ad1a3b54b10a9f022f9f7ded8f98804da66dad51625c8aa868aa_amd64",
                  "9Base-RHBK-26.0:rhbk/keycloak-rhel9@sha256:835ced3d703edf1fa55d563e12049b30ef60f4450f0cc4af8e2ff53e34896657_s390x",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "keycloak-services: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.