CVE-2025-13467

Published: Nov 25, 2025Modified: Jun 17, 2026Deferred

5.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (8)

https://access.redhat.com/errata/RHSA-2025:22088

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:22089

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:22090

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:22091

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-13467

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2416038

Source: secalert@redhat.com

https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328

Source: secalert@redhat.com

https://github.com/keycloak/keycloak/issues/44478

Source: secalert@redhat.com

Timeline

No history available yet.