CVE-2025-11538

Keycloak-server: debug default bind address

State: Published
Severity: 6.8 Medium
Published: Nov 13, 2025
Updated: Dec 19, 2025
Reserved: Oct 9, 2025

Description

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	redhat

Weaknesses

CWE-1327 Binding to an Unrestricted IP Address

Affected Products

Product	Versions
keycloakKeycloak	before 26.4.4Affected
Red Hat build of Keycloak 26.4Red Hat	26.4.4-1 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat	26.4-3 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat	26.4-3 and laterNot affected
Red Hat build of Keycloak 26.4.4Red Hat

References

RHSA-2025:21370vendor-advisory
RHSA-2025:21371vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-11538vdb-entry
RHBZ#2402622issue-tracking
https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9
https://github.com/keycloak/keycloak/pull/43574

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.