~ / search / GHSA-2p82-5wwr-43cw

GHSA-2p82-5wwr-43cw

Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-0604

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-ldap-federation >= 26.1.0, < 26.1.3 26.1.3
Maven org.keycloak:keycloak-ldap-federation < 26.0.10 26.0.10

Details

As written in the advisory (Markdown source, shown as plain text).

The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies.

References

External links from the advisory. They lead to third-party sites.