CVE-2025-11538

Published: Nov 13, 2025Modified: Jun 17, 2026Deferred

6.8

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.6 / Impact: 5.2

Source: secalert@redhat.com (Secondary)

Description

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

Related CWEs

Binding to an Unrestricted IP Address

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

References (6)

https://access.redhat.com/errata/RHSA-2025:21370

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:21371

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-11538

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2402622

Source: secalert@redhat.com

https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9

Source: secalert@redhat.com

https://github.com/keycloak/keycloak/pull/43574

Source: secalert@redhat.com

Timeline

No history available yet.