{"id":"CVE-2025-3501","state":"PUBLISHED","title":"Org.keycloak.protocol.services: keycloak hostname verification","description":"A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.","publishedAt":"2025-04-29T20:45:29.507Z","updatedAt":"2026-09-21T05:27:47.997Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["keycloak","Red Hat Red Hat Build of Keycloak","Red Hat Red Hat build of Keycloak 26","Red Hat Red Hat build of Keycloak 26.0","Red Hat Red Hat build of Keycloak 26.2","Red Hat Red Hat Single Sign-On 7"],"affected":[{"packageName":"keycloak","defaultStatus":"unaffected","versions":[{"version":"25.0.0","status":"affected","lessThan":"25.*","versionType":"semver"},{"version":"26.0.0","status":"affected","lessThan":"26.0.11","versionType":"semver"},{"version":"26.1.0","status":"unknown","lessThan":"26.1.*","versionType":"semver"},{"version":"26.2.0","status":"affected","lessThan":"26.2.2","versionType":"semver"}],"collectionURL":"https://www.keycloak.org/"},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.0"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.2"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","packageName":"rhbk/keycloak-operator-bundle","defaultStatus":"affected","versions":[{"version":"26.0.11-2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.0::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","packageName":"rhbk/keycloak-rhel9","defaultStatus":"affected","versions":[{"version":"26.0-12","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.0::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","packageName":"rhbk/keycloak-rhel9-operator","defaultStatus":"affected","versions":[{"version":"26.0-13","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.0::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.2","packageName":"rhbk/keycloak-operator-bundle","defaultStatus":"affected","versions":[{"version":"26.2.5-1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.2","packageName":"rhbk/keycloak-rhel9","defaultStatus":"affected","versions":[{"version":"26.2-4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.2","packageName":"rhbk/keycloak-rhel9-operator","defaultStatus":"affected","versions":[{"version":"26.2-4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"rh-sso7-keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}],"references":["https://access.redhat.com/errata/RHSA-2025:4335","https://access.redhat.com/errata/RHSA-2025:4336","https://access.redhat.com/errata/RHSA-2025:8672","https://access.redhat.com/errata/RHSA-2025:8690","https://access.redhat.com/security/cve/CVE-2025-3501","https://bugzilla.redhat.com/show_bug.cgi?id=2358834","https://github.com/keycloak/keycloak/issues/39350","https://github.com/keycloak/keycloak/pull/39366"],"weaknesses":["CWE-297"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/3xxx/CVE-2025-3501.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-3501","state":"PUBLISHED","datePublished":"2025-04-29T20:45:29.507Z","dateUpdated":"2026-09-21T05:27:47.997Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-04-10T12:29:29.427Z"},"containers":{"cna":{"title":"Org.keycloak.protocol.services: keycloak hostname verification","descriptions":[{"lang":"en","value":"A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended."}],"affected":[{"packageName":"keycloak","defaultStatus":"unaffected","versions":[{"version":"25.0.0","status":"affected","lessThan":"25.*","versionType":"semver"},{"version":"26.0.0","status":"affected","lessThan":"26.0.11","versionType":"semver"},{"version":"26.1.0","status":"unknown","lessThan":"26.1.*","versionType":"semver"},{"version":"26.2.0","status":"affected","lessThan":"26.2.2","versionType":"semver"}],"collectionURL":"https://www.keycloak.org/"},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.0"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:26.2"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","packageName":"rhbk/keycloak-operator-bundle","defaultStatus":"affected","versions":[{"version":"26.0.11-2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.0::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","packageName":"rhbk/keycloak-rhel9","defaultStatus":"affected","versions":[{"version":"26.0-12","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.0::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","packageName":"rhbk/keycloak-rhel9-operator","defaultStatus":"affected","versions":[{"version":"26.0-13","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.0::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.2","packageName":"rhbk/keycloak-operator-bundle","defaultStatus":"affected","versions":[{"version":"26.2.5-1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.2","packageName":"rhbk/keycloak-rhel9","defaultStatus":"affected","versions":[{"version":"26.2-4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.2","packageName":"rhbk/keycloak-rhel9-operator","defaultStatus":"affected","versions":[{"version":"26.2-4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:build_keycloak:26.2::el9"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"rh-sso7-keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:4335","name":"RHSA-2025:4335","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4336","name":"RHSA-2025:4336","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8672","name":"RHSA-2025:8672","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8690","name":"RHSA-2025:8690","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-3501","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2358834","name":"RHBZ#2358834","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/keycloak/keycloak/issues/39350"},{"url":"https://github.com/keycloak/keycloak/pull/39366"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-297","description":"Improper Validation of Certificate with Host Mismatch","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-09-21T05:27:47.997Z"},"datePublic":"2025-04-29T00:00:00.000Z","x_redhatCweChain":"CWE-297: Improper Validation of Certificate with Host Mismatch","workarounds":[{"lang":"en","value":"Use the correct TLS configuration and avoid using \"--tls-hostname-verifier=any\"."}],"timeline":[{"lang":"en","time":"2025-04-10T12:24:28.784Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-04-29T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-30T15:54:12.219389Z","id":"CVE-2025-3501","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-30T15:54:23.128Z"}}]}}}