CVE-2025-0604GHSA-2P82-5WWR-43CW
Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 26.0.10, 26.1.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- keycloak-ldap-federation
fixed in 26.0.10; fixed in 26.1.3
- Red Hat Red Hat Build of Keycloak
Version range not reported
- rhbk/keycloak-operator-bundle
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- rhbk/keycloak-rhel9-operator
Version range not reported
- keycloak-ldap-federation
Version range not reported
- org.keycloak:keycloak-ldap-federationMaven
From 26.1.0 · fixed in 26.1.3
- org.keycloak:keycloak-ldap-federationMaven
fixed in 26.0.10