CVE-2025-3501
Org.keycloak.protocol.services: keycloak hostname verification
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Org.keycloak.protocol.services: keycloak hostname verification
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
- Record
CVE-2025-3501- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
EUVDEUVD-2025-12660
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
- Record
EUVD-2025-12660- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hw58-3793-42gg
Keycloak hostname verification
A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate verification is skipped, which is unintended.
- Record
GHSA-hw58-3793-42gg- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r934-w73g-v4p8
Duplicate Advisory: Keycloak hostname verification
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-hw58-3793-42gg. This link is maintained to preserve external references.
Original Description
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
- Record
GHSA-r934-w73g-v4p8- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
NVD
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
- Record
CVE-2025-3501- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
OSV
Org.keycloak.protocol.services: keycloak hostname verification
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
- Record
CVE-2025-3501- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
OSVGHSA-hw58-3793-42gg
Keycloak hostname verification
A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate verification is skipped, which is unintended.
- Record
GHSA-hw58-3793-42gg- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
OSVGHSA-r934-w73g-v4p8
Duplicate Advisory: Keycloak hostname verification
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-hw58-3793-42gg. This link is maintained to preserve external references.
Original Description
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
- Record
GHSA-r934-w73g-v4p8- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven |
before 26.2.2 | 26.2.2 |
org.keycloak:keycloak-servicesMaven |
before 26.2.2, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
26.2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-3501 is a high vulnerability (CVSS 8.2) in Red Hat Build Of Keycloak, published April 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in org.keycloak:keycloak-services 26.2.2.
References
access.redhat.com/errata/RHSA-2025:4335
bugzilla.redhat.com/show_bug.cgi?id=2358834
Show 12 moreShow less
github.com/keycloak/keycloak/issues/39350
nvd.nist.gov/vuln/detail/CVE-2025-3501
catalog.redhat.com/software/containers
keycloak.org
Left out here: 148 versions. The JSON record has them.