CVE-2025-1391: Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gvgg-2r3r-53x7. This link is maintained to preserve external references.
Original Description A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
Other sources
This vulnerability is caused by the improper mapping of users to organizations based solely on email/username patterns. The issue is limited to the token claim level, meaning the user is not truly added to the organization but may appear as such in applications relying on these claims. The risk increases in scenarios where self-registration is enabled and unrestricted, allowing an attacker to exploit the naming pattern. The issue is mitigated if admins restrict registration or use strict validation mechanisms.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.0.10 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.1.3 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.1.2 - Compensating control
Mitigate the Keycloak organization mapper improper authorization risk by restricting registration (especially when self-registration is enabled) or using strict validation mechanisms so attackers cannot exploit email/username-to-organization domain pattern mappings.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1391?
CVE-2025-1391 is classified as a medium severity vulnerability due to its potential impact on user organization assignments in Keycloak.
How do I fix CVE-2025-1391?
To fix CVE-2025-1391, update Red Hat Keycloak to the latest version that addresses this vulnerability.
What are the implications of CVE-2025-1391 for users?
CVE-2025-1391 can lead to improper organization assignments, which may result in incorrect access control and user permissions.
Which software versions are affected by CVE-2025-1391?
CVE-2025-1391 affects the Red Hat Build of Keycloak, specifically versions prior to the fix.
What is the root cause of CVE-2025-1391?
The root cause of CVE-2025-1391 is a flaw at the mapper level in Keycloak that allows incorrect organization assignment based on matching username or email patterns.