GHSA-gv3v-2cpp-3pmq
Keycloak logs sensitive headers
At a glance
- Published
- Updated
- CVE
- CVE-2025-11537
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Description
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise. Patches are available, see: - https://github.com/keycloak/keycloak/releases/tag/26.4.11 - https://github.com/keycloak/keycloak/releases/tag/26.5.6 - https://github.com/keycloak/keycloak/releases/tag/26.6.0
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-quarkus-server | introduced 0, fixed 26.5.6 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-11537 ADVISORY
- https://github.com/keycloak/keycloak/commit/137a35c1109ff43a305f26264978a3ea21452373 WEB
- https://github.com/keycloak/keycloak/commit/5a3cdb7c4ccbf83ffc926f70d655a60269d7207b WEB
- https://github.com/keycloak/keycloak/commit/9622f550a6e565b29a3a37454421f08626791a6c WEB
- https://access.redhat.com/errata/RHEA-2025:19385 WEB
- https://access.redhat.com/errata/RHEA-2025:19386 WEB
- https://access.redhat.com/security/cve/CVE-2025-11537 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2402616 WEB
- https://github.com/keycloak/keycloak PACKAGE
- https://www.keycloak.org/server/logging#_change_log_formatpattern WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |