CVE-2025-3910
Fixed upstream EPSS <1%CVSS 5.4
A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
Products: Red Hat Build of Keycloak, Red Hat build of Keycloak 26.0
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.2.2 |