Threat Investigation
Request a demo

CVE-2025-0604

Medium

Description

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.

SeverityMedium
CVSS5.4
Exploit probability—
ProductOrg.keycloak:keycloak-ldap-federation
PublishedJan 22, 2025
First seenJan 22, 2025
Weakness typeCWE-287Improper authentication

How to fix

Update
  • org.keycloak:keycloak-ldap-federation26.1.3, 26.0.10 or later
Vendor advisories

Affected products

ProductAffected versionsFixed in
org.keycloak:keycloak-ldap-federationMaven26.1.0 ≤ v < 26.1.3, v < 26.0.1026.1.3, 26.0.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.