CVE-2025-0604
Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
- State
- Published
- Severity
- 5.4 Medium
- Published
- Jan 22, 2025
- Updated
- Oct 13, 2026
- Reserved
- Jan 20, 2025
Description
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
keycloak-ldap-federation |
|
Red Hat Build of KeycloakRed Hat | |
Red Hat build of Keycloak 26.0Red Hat |
|
Red Hat build of Keycloak 26.0Red Hat |
|
Red Hat build of Keycloak 26.0Red Hat |
|
Red Hat Single Sign-On 7Red Hat |
References
- RHSA-2025:2544vendor-advisory
- RHSA-2025:2545vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-0604vdb-entry
- RHBZ#2338993issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.