VDB

CVE-2025-13467

CVE-2025-13467 PUBLISHED CVSS 5.5 MEDIUM

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

EPSS 0.06% · 19.7th percentile

Risk Scores

CVSS v3.1
5.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
EPSS Score
0.06%
19.7th percentile

Affected Products

VendorProductVersions
Red HatRed Hat build of Keycloak 26.226.2-12
Red HatRed Hat build of Keycloak 26.426.4-5
Red HatRed Hat build of Keycloak 26.4.6
Mavenorg.keycloak:keycloak-ldap-federation26.3.0, 0
KeycloakKeycloak0
Red HatRed Hat build of Keycloak 26.226.2-12
Red HatRed Hat build of Keycloak 26.2.11
Red HatRed Hat build of Keycloak 26.226.2.11-1
Red HatRed Hat build of Keycloak 26.426.4-6
Red HatRed Hat build of Keycloak 26.426.4.6-1

Timeline

  • Nov 25, 2025 Coalition ESS Score
  • Nov 25, 2025 Coalition ESS Score
  • Nov 25, 2025 CVE Published
  • Nov 25, 2025 PoC Published
  • Nov 26, 2025 EPSS Score
  • Nov 26, 2025 Coalition ESS Score
  • Nov 29, 2025 Coalition ESS Score
  • Dec 1, 2025 EPSS Score
  • Dec 2, 2025 Coalition ESS Score
  • Dec 5, 2025 EPSS Score
  • Dec 10, 2025 EPSS Score
  • Dec 13, 2025 Coalition ESS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›