CVE-2025-11537

The record

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.

Affected packages

Related vulnerabilities

• GHSA-gv3v-2cpp-3pmq Keycloak logs sensitive headers Same vulnerability
• GHSA-v897-pv23-r8cw Keycloak has an improper input validation vulnerability Also affects org.keycloak:keycloak-quarkus-server
• CVE-2026-0976 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
• CVE-2025-11538 A vulnerability exists in Keycloak's server distribution where enabling debug mode… Also affects org.keycloak:keycloak-quarkus-server
• CVE-2025-10939 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
• CVE-2026-109786 In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter… CWE-117
• CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. CWE-117
• CVE-2026-14350 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an… CWE-117