CVE-2025-11538CWE-1327

CVE-2025-11538

Medium · published November 13, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-1327 · Binding to an Unrestricted IP Address
Published
2025-11-13T22:15Z
References (6)
https://access.redhat.com/errata/RHSA-2025:21370 · [email protected]https://access.redhat.com/errata/RHSA-2025:21371 · [email protected]https://access.redhat.com/security/cve/CVE-2025-11538 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2402622 · [email protected]https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9 · [email protected]https://github.com/keycloak/keycloak/pull/43574 · [email protected]
EPSS history
Timeline
  • 13 NOV 16:47Z
    Keycloak-server: debug default bind address
    cvelistv5