Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

概要

参考情報

• keycloak/keycloak security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-13467 · ADVISORY
• keycloak/keycloak · WEB
• keycloak/keycloak commit 754c070 · WEB
• keycloak/keycloak commit b90fec4 · WEB
• access.redhat.com/errata/RHSA-2025:22088 · WEB
• access.redhat.com/security/cve/CVE-2025-13467 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• keycloak/keycloak · PACKAGE
• keycloak/keycloak release 26.4.6 · WEB
• access.redhat.com/errata/RHSA-2025:22089
• access.redhat.com/errata/RHSA-2025:22090

org.keycloak:keycloak-ldap-federation のその他の脆弱性

• CVE-2026-9801中 4.9A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Dire…
• CVE-2025-0604中 5.4A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to …
• CVE-2022-2232高 7.5A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potenti…
• CVE-2024-5967低 2.7A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL  independently without re-entering the c…