CVE-2025-1391
Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
- State
- Published
- Severity
- 5.4 Medium
- Published
- Feb 17, 2025
- Updated
- Sep 21, 2026
- Reserved
- Feb 17, 2025
Description
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
keycloak-services |
|
Red Hat Build of KeycloakRed Hat | |
Red Hat build of Keycloak 26.0Red Hat |
|
Red Hat build of Keycloak 26.0Red Hat |
|
Red Hat build of Keycloak 26.0Red Hat |
|
References
- RHSA-2025:2544vendor-advisory
- RHSA-2025:2545vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-1391vdb-entry
- RHBZ#2346082issue-tracking
- https://github.com/keycloak/keycloak/issues/37169
- https://github.com/keycloak/keycloak/pull/37235
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.