CVE-2025-13467
Fixed in a distro release EPSS <1%CVSS 5.5
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
Products: keycloak, Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.11, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.6
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-ldap-federation | 26.4.6 |
| Maven | org.keycloak:keycloak-ldap-federation | 26.2.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.2 | 26.2.5-r7 |
| Chainguard | keycloak-26.2-compat | 26.2.5-r7 |
| Chainguard | keycloak-26.2-iamguarded-compat | 26.2.5-r7 |
| Chainguard | keycloak-fips-26.2-iamguarded-fips | 26.2.5-r9 |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | 26.3.5-r5 |