GHSA-4hx9-48xh-5mxr (CVE-2025-13467)

Details

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

Mitigation

Disable LDAP referrals in all LDAP user providers in all realms if projects cannot upgrade to the patched versions.

Affected Packages

org.keycloak:keycloak-ldap-federation

Maven

Fixed in:

26.4.6

References

WEBhttps://access.redhat.com/errata/RHSA-2025:22088 WEBhttps://access.redhat.com/security/cve/CVE-2025-13467 WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2416038 ADVISORYhttps://github.com/advisories/GHSA-4hx9-48xh-5mxr PACKAGEhttps://github.com/keycloak/keycloak WEBhttps://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328 WEBhttps://github.com/keycloak/keycloak/issues/44478 WEBhttps://github.com/keycloak/keycloak/releases/tag/26.4.6 WEBhttps://github.com/keycloak/keycloak/security/advisories/GHSA-4hx9-48xh-5mxr ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-13467

GHSA-4hx9-48xh-5mxr

Details

Mitigation

Affected Packages

References

Aliases

CVSS Analysis

Related

Ecosystems

Timeline