CVE-2025-0604: Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
First published: Mon Jan 20 2025(Updated: )
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.keycloak:keycloak-ldap-federation | <=26.1.0 | |
| Red Hat Keycloak |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-0604?
CVE-2025-0604 is classified as a high-severity vulnerability due to the potential unauthorized access it allows.
How do I fix CVE-2025-0604?
To mitigate CVE-2025-0604, ensure you configure Keycloak to properly validate user credentials with an LDAP bind during password resets.
Which software versions are affected by CVE-2025-0604?
CVE-2025-0604 affects Keycloak versions up to and including 26.1.0 in the keycloak-ldap-federation package.
What kind of access does CVE-2025-0604 provide to users?
CVE-2025-0604 allows users with expired or disabled Active Directory accounts to regain access to Keycloak.
Is CVE-2025-0604 related to Active Directory?
Yes, CVE-2025-0604 specifically involves a vulnerability in Keycloak related to password resets for Active Directory users.
- agent/title
- agent/weakness
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-0604
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-m3hp-8546-5qmr
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/source
- agent/event
- collector/nvd-cve
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/guess-ai
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/github-advisory
- package-manager/maven
- vendor/keycloak
- canonical/red hat keycloak