CVE-2025-0604: Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2p82-5wwr-43cw. This link is maintained to preserve external references.
Original Description
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
Other sources
The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-ldap-federationto a version that resolves this vulnerability.Fixed in 26.0.10 - Upgrade
Upgrade
maven/org.keycloak:keycloak-ldap-federationto a version that resolves this vulnerability.Fixed in 26.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0604?
CVE-2025-0604 is classified as a high-severity vulnerability due to the potential unauthorized access it allows.
How do I fix CVE-2025-0604?
To mitigate CVE-2025-0604, ensure you configure Keycloak to properly validate user credentials with an LDAP bind during password resets.
Which software versions are affected by CVE-2025-0604?
CVE-2025-0604 affects Keycloak versions up to and including 26.1.0 in the keycloak-ldap-federation package.
What kind of access does CVE-2025-0604 provide to users?
CVE-2025-0604 allows users with expired or disabled Active Directory accounts to regain access to Keycloak.
Is CVE-2025-0604 related to Active Directory?
Yes, CVE-2025-0604 specifically involves a vulnerability in Keycloak related to password resets for Active Directory users.