CVE-2025-3501CWE-297

CVE-2025-3501

High · published April 30, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.0th percentile
Weakness
CWE-297 · Improper Validation of Certificate with Host Mismatch
Published
2025-04-30T01:15Z
References (8)
https://access.redhat.com/errata/RHSA-2025:4335 · [email protected]https://access.redhat.com/errata/RHSA-2025:4336 · [email protected]https://access.redhat.com/errata/RHSA-2025:8672 · [email protected]https://access.redhat.com/errata/RHSA-2025:8690 · [email protected]https://access.redhat.com/security/cve/CVE-2025-3501 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2358834 · [email protected]https://github.com/keycloak/keycloak/issues/39350 · [email protected]https://github.com/keycloak/keycloak/pull/39366 · [email protected]
EPSS history
Timeline
  • 29 APR 20:45Z
    Org.keycloak.protocol.services: keycloak hostname verification
    cvelistv5