cve-program · CVE-2025-3501
Published
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2025-3501
Publishedkeycloak
https://www.keycloak.org/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"versions": [
{
"status": "affected",
"version": "25.0.0",
"lessThan": "25.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "26.0.0",
"lessThan": "26.0.11",
"versionType": "semver"
},
{
"status": "unknown",
"version": "26.1.0",
"lessThan": "26.1.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "26.2.0",
"lessThan": "26.2.2",
"versionType": "semver"
}
],
"packageName": "keycloak",
"collectionURL": "https://www.keycloak.org/",
"defaultStatus": "unaffected"
}keycloak
https://access.redhat.com/downloads/content/package-browser/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"packageName": "keycloak",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.0"
]
}Red Hat build of Keycloak 26
https://access.redhat.com/downloads/content/package-browser/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2"
]
}rhbk/keycloak-operator-bundle
https://catalog.redhat.com/software/containers/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.0",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"defaultStatus": "affected",
"versions": [
{
"version": "26.0.11-2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.0::el9"
]
}rhbk/keycloak-rhel9
https://catalog.redhat.com/software/containers/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.0",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "26.0-12",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.0::el9"
]
}rhbk/keycloak-rhel9-operator
https://catalog.redhat.com/software/containers/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.0",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"defaultStatus": "affected",
"versions": [
{
"version": "26.0-13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.0::el9"
]
}rhbk/keycloak-operator-bundle
https://catalog.redhat.com/software/containers/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"defaultStatus": "affected",
"versions": [
{
"version": "26.2.5-1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
]
}rhbk/keycloak-rhel9
https://catalog.redhat.com/software/containers/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "26.2-4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
]
}rhbk/keycloak-rhel9-operator
https://catalog.redhat.com/software/containers/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"defaultStatus": "affected",
"versions": [
{
"version": "26.2-4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
]
}rh-sso7-keycloak
https://access.redhat.com/downloads/content/package-browser/
Publisher's version information
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-sso7-keycloak",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
]
}Original source record · Cite this exact observation · Complete original publisher JSON