CVE-2025-3501 Org.keycloak.protocol.services: keycloak hostname verification
Attackers can bypass certificate verification in Keycloak by configuring a specific verification policy, potentially enabling man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-3501?
CVE-2025-3501 is a high-severity vulnerability in Red Hat Build of Keycloak, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Weakness: CWE-297
Which versions are affected by CVE-2025-3501?
2 open source packages ship an affected version, including org.keycloak:keycloak-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions | 26.2.2 |
org.keycloak:keycloak-services Maven | All versions | 26.2.2 |
How do I fix CVE-2025-3501?
Upgrade org.keycloak:keycloak-services to 26.2.2 or later.
Is CVE-2025-3501 being exploited?
There is no known exploitation of CVE-2025-3501 in the wild and no public exploit code.
Sources
Also known as ECHO-32d8-b09c-5c73, GHSA-hw58-3793-42gg.