PT-2025-36327 · Red Hat · Keycloak

Published 2025-09-05 · Updated 2025-12-19 · CVE-2025-10044

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak where the account console and other pages accept arbitrary text in the error description query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents cross-site scripting (XSS), an attacker can craft URLs with misleading messages, such as fake support phone numbers or URLs, which are displayed within the trusted Keycloak user interface. This creates a phishing vector, potentially tricking users into contacting malicious actors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10044

ECHO-6C12-D103-6B0A

GHSA-27GC-WJ6X-9W55

GHSA-XMCW-MV9P-7PQ2

Affected Products

Keycloak

References · 27

• https://access.redhat.com/errata/RHSA-2025:19925 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:16399 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:16400 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-10044 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xmcw-mv9p-7pq2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10044 · Security Note
• https://osv.dev/vulnerability/GHSA-27gc-wj6x-9w55 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:19923 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/pull/42443 · Note
• https://github.com/keycloak/keycloak/pull/42035 · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-27gc-wj6x-9w55 · Note
• https://reddit.com/r/VulnMatter/comments/1ocduv6/resumen_diario_de_vulnerabilidades_21102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1964091431783415839 · Twitter Post
• https://t.me/CVEtracker/31820 · Telegram Post