What’s Vulnerable › Vulnerabilities

CVE-2025-13467: Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-25 · updated 2026-10-18
• Weakness: CWE-502

Description

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

Affected products

• Red Hat build of Keycloak 26.4: all versions — fixed in 26.2-12, 26.2.11-1, 26.4-5, 26.4-6, 26.4.6-1
• Keycloak: before 26.4.6 — fixed in 26.4.6

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.2-12, 26.2.11-1, 26.4-5, 26.4-6; Keycloak 26.4.6. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:22088
• https://access.redhat.com/errata/RHSA-2025:22089
• https://access.redhat.com/errata/RHSA-2025:22090
• https://access.redhat.com/errata/RHSA-2025:22091
• https://access.redhat.com/security/cve/CVE-2025-13467
• https://bugzilla.redhat.com/show_bug.cgi?id=2416038
• https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328
• https://github.com/keycloak/keycloak/issues/44478

Get alerted when CVE-2025-13467 or the next vulnerability affects your stack