PT-2025-46862 · Red Hat · Keycloak

Steven Hawkins · Published 2025-11-13 · Updated 2025-12-01 · CVE-2025-11538

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A security issue exists in Keycloak where enabling debug mode with the --debug flag insecurely binds the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, potentially allowing a malicious actor on the same network segment to attach a remote debugger and execute code remotely within the Keycloak Java virtual machine. The vulnerable parameter is <port>.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1327

Related Identifiers

CVE-2025-11538

GHSA-7M9G-PMXF-M9M8

GHSA-J4VQ-Q93M-4683

Affected Products

Keycloak

References · 14

• https://osv.dev/vulnerability/GHSA-7m9g-pmxf-m9m8 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:21371 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:21370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11538 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11538 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9 · Note
• https://github.com/keycloak/keycloak/pull/43574 · Note
• https://reddit.com/r/VulnMatter/comments/1ox660i/resumen_diario_de_vulnerabilidades_14112025 · Reddit Post
• https://access.redhat.com/security/cve/CVE-2025-11538 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2402622 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11538 · Note
• https://twitter.com/VulmonFeeds/status/1989145990952092013 · Twitter Post
• https://t.me/CVEtracker/37253 · Telegram Post