What’s Vulnerable › Vulnerabilities

CVE-2025-3501: Org.keycloak.protocol.services: keycloak hostname verification

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-29 · updated 2026-09-21
• Weakness: CWE-297

Description

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.

Affected products

• Red Hat build of Keycloak 26.4: all versions — fixed in 26.0-12, 26.0-13, 26.0.11-2, 26.2-4, 26.2.5-1

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.0-12, 26.0-13, 26.0.11-2, 26.2-4. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:4335
• https://access.redhat.com/errata/RHSA-2025:4336
• https://access.redhat.com/errata/RHSA-2025:8672
• https://access.redhat.com/errata/RHSA-2025:8690
• https://access.redhat.com/security/cve/CVE-2025-3501
• https://bugzilla.redhat.com/show_bug.cgi?id=2358834
• https://github.com/keycloak/keycloak/issues/39350
• https://github.com/keycloak/keycloak/pull/39366

Get alerted when CVE-2025-3501 or the next vulnerability affects your stack