CVE-2025-8419: Org.keycloak/keycloak-services: keycloak smtp inject vulnerability
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
Other sources
Email injection that can send a spam message (very short) to an email eddress.
1. Using for example the email registration the attacker uses a crafted email address with UTF-8 characters like: 甲申申甶甴甸电甹甸甸畀畱畱瘮畣畯畭甾瘍瘊畄畁畔畁瘍瘊畓畵畢番略畣畴町畐畗畎畅畄瘍瘊瘍瘊畈畡畣畫瘡瘍瘊瘮瘍瘊畑畕畉畔瘍瘊 2. The special chars in UTF-8 have in lower byte the value: 2336485988>\r\nDATA\r\nSubject:PWNED\r\n\r\nHack!\r\n.\r\nQUIT\r\n 3. This creates the email injection that sends the email to the address 2336485988
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.3.3 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 26.2.8
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8419?
CVE-2025-8419 is considered a moderate severity vulnerability due to its potential for SMTP injection during e-mail registration.
How do I fix CVE-2025-8419?
To mitigate CVE-2025-8419, update Keycloak-services to version 26.3.3 or later, which addresses the SMTP injection issue.
What impact does CVE-2025-8419 have on email functionality?
CVE-2025-8419 may allow attackers to send short unwanted emails through SMTP injection during user registration.
Which versions of Keycloak-services are affected by CVE-2025-8419?
CVE-2025-8419 affects Keycloak-services versions up to and including 26.3.2.
Is CVE-2025-8419 a remote or local vulnerability?
CVE-2025-8419 is a remote vulnerability, as it can be exploited over the network during the email registration process.