PT-2025-32199 · Red Hat · Keycloak

Osidb Bzimport · Published 2025-08-06 · Updated 2025-09-17 · CVE-2025-8419

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak-services where special characters used during email registration may allow SMTP Injection, resulting in the sending of unsolicited emails from the Keycloak server. The attack is limited to short emails (approximately 60 characters) due to the 64-character limit on the local part of the email address. While the direct consequence is limited to sending unwanted emails, this action could potentially be a precursor to more sophisticated attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-93

Related Identifiers

BDU:2025-09476

CVE-2025-8419

ECHO-891D-8502-3521

GHSA-M4J5-5X4R-2XP9

GHSA-QJ5R-2R5P-PHC7

Affected Products

Keycloak

References · 22

• https://osv.dev/vulnerability/GHSA-qj5r-2r5p-phc7 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:15336 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8419 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2385776 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:15338 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:15337 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:15339 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m4j5-5x4r-2xp9 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-8419 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09476 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-8419 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-m4j5-5x4r-2xp9 · Note
• https://github.com/DonkeyXBT/vulnerability_tracker/issues/5724 · Note
• https://twitter.com/CVEnew/status/1953150979563561432 · Twitter Post