Riskcovery

CVE-2025-8419

Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

State
Published
Severity
5.3 Medium
Published
Aug 6, 2025
Updated
Aug 31, 2026
Reserved
Jul 31, 2025

Read the record on cve.org

Description

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nredhat

Weaknesses

  • CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected Products

ProductVersions
keycloakKeycloak
  • before 26.3.3Affected
Red Hat build of Keycloak 26.0Red Hat
    Red Hat build of Keycloak 26.0Red Hat
    • 26.0.15-1 and laterNot affected
    Red Hat build of Keycloak 26.0Red Hat
    • 26.0-18 and laterNot affected
    Red Hat build of Keycloak 26.0Red Hat
    • 26.0-19 and laterNot affected
    Red Hat build of Keycloak 26.2Red Hat
      Red Hat build of Keycloak 26.2Red Hat
      • 26.2.8-1 and laterNot affected
      Red Hat build of Keycloak 26.2Red Hat
      • 26.2-8 and laterNot affected
      Red Hat build of Keycloak 26.2Red Hat
      • 26.2-8 and laterNot affected
      Red Hat Build of KeycloakRed Hat

        References

        Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.