CVE-2025-11537
Keycloak-services: sensitive headers shown in the http access logs
- State
- Published
- Severity
- 5.0 Medium
- Published
- Feb 10, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 9, 2025
Description
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.0 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-117 Improper Output Neutralization for Logs
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4.2Red Hat | |
Red Hat Build of KeycloakRed Hat |
References
- RHEA-2025:19385vendor-advisory
- RHEA-2025:19386vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-11537vdb-entry
- RHBZ#2402616issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.