PT-2025-18208 · Red Hat+1 · Keycloak+1

Marek Posolda · Published 2025-04-29 · Updated 2025-11-01 · CVE-2025-3910

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak, specifically in the org.keycloak.authorization package, which may be vulnerable to circumventing required actions. This allows users to bypass requirements such as setting up two-factor authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2025-13422

ALT-PU-2025-6486

CVE-2025-3910

ECHO-1C40-A261-F423

GHSA-5JFQ-X6XP-7RW2

GHSA-FX44-2WX5-5FVP

Affected Products

Alt Linux

Keycloak

References · 17

• https://access.redhat.com/errata/RHSA-2025:4335 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3910 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5jfq-x6xp-7rw2 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:4336 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2361923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3910 · Security Note
• https://osv.dev/vulnerability/GHSA-fx44-2wx5-5fvp · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-3910 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/39349 · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-5jfq-x6xp-7rw2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3910 · Note
• https://twitter.com/CVEnew/status/1917326663005720961 · Twitter Post
• https://t.me/cvedetector/24057 · Telegram Post
• https://t.me/cveNotify/132679 · Telegram Post