Security Advisory catalog CVE-2025-3910
cve-program · CVE-2025-3910 Published
A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2025-3910 Published keycloak https://www.keycloak.org/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"versions": [
{
"status": "affected",
"version": "25.0.0",
"lessThan": "25.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "26.0.0",
"lessThan": "26.0.11",
"versionType": "semver"
},
{
"status": "unknown",
"version": "26.1.0",
"lessThan": "26.1.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "26.2.0",
"lessThan": "26.2.2",
"versionType": "semver"
}
],
"packageName": "keycloak",
"collectionURL": "https://www.keycloak.org/",
"defaultStatus": "unaffected"
} org.keycloak.authentication https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"packageName": "org.keycloak.authentication",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.0"
]
} rhbk/keycloak-operator-bundle https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.0",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"defaultStatus": "affected",
"versions": [
{
"version": "26.0.11-2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.0::el9"
]
} rhbk/keycloak-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.0",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "26.0-12",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.0::el9"
]
} rhbk/keycloak-rhel9-operator https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.0",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"defaultStatus": "affected",
"versions": [
{
"version": "26.0-13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.0::el9"
]
} Original source record · Cite this exact observation · Complete original publisher JSON