CVE-2025-11537: Keycloak-services: sensitive headers shown in the http access logs

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-10 · updated 2026-10-30
Weakness: CWE-117

Description

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.

Affected products

Red Hat build of Keycloak 26.4: all versions

References

https://access.redhat.com/errata/RHEA-2025:19385
https://access.redhat.com/errata/RHEA-2025:19386
https://access.redhat.com/security/cve/CVE-2025-11537
https://bugzilla.redhat.com/show_bug.cgi?id=2402616

Get alerted when CVE-2025-11537 or the next vulnerability affects your stack