CVE-2025-11537: Keycloak-services: sensitive headers shown in the http access logs
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-quarkus-serverto a version that resolves this vulnerability.Fixed in 26.6.0 - Configuration
Update the Keycloak logging format so it is not verbose and does not log sensitive headers such as Authorization and Cookie in cleartext (avoid patterns like the predefined 'long').
Keycloak Logging format/user-supplied pattern = Do not use verbose user-supplied patterns such as the predefined 'long' pattern; configure a safer (non-verbose) logging pattern that does not include sensitive headers - Compensating control
Protect Keycloak log files so only authorized administrators can read them (reduce/limit read access to the http access logs containing sensitive header content).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11537?
CVE-2025-11537 is classified as a high severity vulnerability due to the exposure of sensitive information in access logs.
How can I mitigate CVE-2025-11537?
To mitigate CVE-2025-11537, configure the logging format to eliminate sensitive data exposure, or update to Keycloak version 26.6.0 or later.
Which versions of Keycloak are affected by CVE-2025-11537?
CVE-2025-11537 affects all versions of Keycloak prior to 26.6.0.
What type of sensitive information is exposed in CVE-2025-11537?
CVE-2025-11537 exposes sensitive headers including Authorization and Cookie in the HTTP access logs.
Is there a specific logging configuration that causes CVE-2025-11537?
Yes, the vulnerability occurs when the logging format is set to a verbose, user-defined pattern, such as the 'long' pattern.