CVE-2025-0604

mediumpriority · track · 0EPSS 0.007 · 52 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.68% (52nd) EPSS

CVSS 5.4 · medium

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · scored 2026-10-27

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.

cvss

Technical severity, 0–10. One row per scoring source.

5.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · secalert@redhat.com USexploitability 2.8 · impact 2.5

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nsecondary · OSV

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USCWE-287US

affected products (9)

Products and version ranges known to be affected.

Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
Open Source Keycloak <=26.1.0all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Open Source Keycloak≤ 26.1.0cert_bundDE
Red Hat Red Hat build of Keycloak 26.0< 26.0-11enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.0< 26.0-12enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.0< 26.0.10-3enisa_euvdEU
Maven org.keycloak:keycloak-ldap-federation< 26.0.10osvUSpkg:maven/org.keycloak/keycloak-ldap-federation
Maven org.keycloak:keycloak-ldap-federation26.1.0 → 26.1.3osvUSpkg:maven/org.keycloak/keycloak-ldap-federation

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0173Keycloak: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-01-22csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-2p82-5wwr-43cwAuthentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak2025-03-10ghsa · osvUS
The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

published 2025-01-22modified 2026-08-31

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan