CVE-2025-0604 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
Attackers can bypass Active Directory restrictions to regain access to Keycloak accounts after password resets, potentially leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-0604?
CVE-2025-0604 is a medium-severity authentication bypass vulnerability in Red Hat Build of Keycloak, published on 22 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
Weakness: CWE-287
Which versions are affected by CVE-2025-0604?
4 open source packages ship an affected version, including org.keycloak:keycloak-ldap-federation.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-ldap-federation Maven | All versions | 26.0.10 |
org.keycloak:keycloak-ldap-federation Maven | All versions | 26.0.10 |
org.keycloak:keycloak-ldap-federation Maven | From 26.1.0 | 26.1.3 |
org.keycloak:keycloak-ldap-federation Maven | From 26.1.0 | 26.1.3 |
How do I fix CVE-2025-0604?
Upgrade org.keycloak:keycloak-ldap-federation to a fixed version for your release line: 26.0.10 or 26.1.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-0604 being exploited?
There is no known exploitation of CVE-2025-0604 in the wild and no public exploit code.
Sources
Also known as ECHO-0030-65ec-f55d, GHSA-2p82-5wwr-43cw.