Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

Mô tả

Tham khảo

• keycloak/keycloak security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-13467 · ADVISORY
• keycloak/keycloak · WEB
• keycloak/keycloak commit 754c070 · WEB
• keycloak/keycloak commit b90fec4 · WEB
• access.redhat.com/errata/RHSA-2025:22088 · WEB
• access.redhat.com/security/cve/CVE-2025-13467 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• keycloak/keycloak · PACKAGE
• keycloak/keycloak release 26.4.6 · WEB
• access.redhat.com/errata/RHSA-2025:22089
• access.redhat.com/errata/RHSA-2025:22090

Lỗ hổng khác của org.keycloak:keycloak-ldap-federation

• CVE-2026-9801TRUNG BÌNH 4.9A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Dire…
• CVE-2025-0604TRUNG BÌNH 5.4A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to …
• CVE-2022-2232CAO 7.5A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potenti…
• CVE-2024-5967THẤP 2.7A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL  independently without re-entering the c…