CVE-2025-13467
Medium · 5.5CVSS
5.5
EPSS
0.4%
Published
Nov 25, 2025
CISA due date
—
The record
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.keycloak:keycloak-ldap-federation | 0 | 26.4.6 |
| Maven | org.keycloak:keycloak-ldap-federation | 0 | 26.2.11 |
| Maven | org.keycloak:keycloak-ldap-federation | 26.3.0 | 26.4.6 |
| Chainguard | keycloak-26.2 | 0 | 26.2.5-r7 |
| Chainguard | keycloak-26.2-bitnami-compat | 0 | 26.2.5-r7 |
| Chainguard | keycloak-26.2-compat | 0 | 26.2.5-r7 |
| Chainguard | keycloak-26.2-iamguarded-compat | 0 | 26.2.5-r7 |
| Chainguard | keycloak-26.3 | 0 | 26.3.5-r4 |
| Chainguard | keycloak-26.3-bitnami-compat | 0 | 26.3.5-r4 |
| Chainguard | keycloak-26.3-compat | 0 | 26.3.5-r4 |
| Chainguard | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r4 |
| Chainguard | keycloak-fips-26.2 | 0 | 26.2.5-r9 |
| Chainguard | keycloak-fips-26.2-bitnami-fips | 0 | 26.2.5-r9 |
| Chainguard | keycloak-fips-26.2-iamguarded-fips | 0 | 26.2.5-r9 |
| Chainguard | keycloak-fips-26.3 | 0 | 26.3.5-r5 |
| Chainguard | keycloak-fips-26.3-bitnami-fips | 0 | 26.3.5-r5 |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | 0 | 26.3.5-r5 |
| Chainguard | keycloak-fips-26.3-operator | 0 | 26.3.5-r5 |
| Chainguard | keycloak-fips-26.3-operator-compat | 0 | 26.3.5-r5 |
| Wolfi | keycloak-26.3 | 0 | 26.3.5-r4 |
| Wolfi | keycloak-26.3-bitnami-compat | 0 | 26.3.5-r4 |
| Wolfi | keycloak-26.3-compat | 0 | 26.3.5-r4 |
| Wolfi | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r4 |
Related vulnerabilities
- GHSA-4hx9-48xh-5mxr Keycloak LDAP User Federation provider enables admin-triggered untrusted Java… Same vulnerability
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects keycloak-26.2
- CVE-2025-14082 A flaw was found in Keycloak Admin REST (Representational State Transfer) API. Also affects keycloak-26.2
- CVE-2025-11538 A vulnerability exists in Keycloak's server distribution where enabling debug mode… Also affects keycloak-26.2
- CVE-2025-12390 A flaw was found in Keycloak. Also affects keycloak-26.2
- CVE-2025-58056 Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions Also affects keycloak-26.2
- CVE-2025-58057 Netty's decoders vulnerable to DoS via zip bomb style attack Also affects keycloak-26.2
- CVE-2025-55163 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Also affects keycloak-26.2