ByteOS Network

CVE Vulnerability Details :

CVE-2025-3501

PUBLISHED

More Info Official Page

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-29 Apr, 2025 | 20:45

Updated At-20 Nov, 2025 | 07:27

▼CVE Numbering Authority (CNA)

Org.keycloak.protocol.services: keycloak hostname verification

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.

Affected Products

Collection URL

https://www.keycloak.org/

Package Name

keycloak

Default Status

unaffected

Versions

Affected

From 25.0.0 before 25.* (semver)
From 26.0.0 before 26.0.11 (semver)
From 26.2.0 before 26.2.2 (semver)

unknown

From 26.1.0 before 26.1.* (semver)

Vendor

Red Hat, Inc.

Product

Red Hat Build of Keycloak

Collection URL

https://access.redhat.com/downloads/content/package-browser/

Package Name

keycloak

CPEs

cpe:/a:redhat:build_keycloak:26

Default Status

unaffected

Vendor

Red Hat, Inc.

Product

Red Hat build of Keycloak 26

Collection URL

https://access.redhat.com/downloads/content/package-browser/

CPEs

cpe:/a:redhat:build_keycloak:26

Default Status

unaffected

Vendor

Red Hat, Inc.

Product

Red Hat build of Keycloak 26.0

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

rhbk/keycloak-operator-bundle

CPEs

cpe:/a:redhat:build_keycloak:26.0::el9

Default Status

affected

Versions

Unaffected

From 26.0.11-2 before * (rpm)

Vendor

Red Hat, Inc.

Product

Red Hat build of Keycloak 26.0

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

rhbk/keycloak-rhel9

CPEs

cpe:/a:redhat:build_keycloak:26.0::el9

Default Status

affected

Versions

Unaffected

From 26.0-12 before * (rpm)

Vendor

Red Hat, Inc.

Product

Red Hat build of Keycloak 26.0

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

rhbk/keycloak-rhel9-operator

CPEs

cpe:/a:redhat:build_keycloak:26.0::el9

Default Status

affected

Versions

Unaffected

From 26.0-13 before * (rpm)

Vendor

Red Hat, Inc.

Product

Red Hat build of Keycloak 26.2

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

rhbk/keycloak-operator-bundle

CPEs

cpe:/a:redhat:build_keycloak:26.2::el9

Default Status

affected

Versions

Unaffected

From 26.2.5-1 before * (rpm)

Vendor

Red Hat, Inc.

Product

Red Hat build of Keycloak 26.2

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

rhbk/keycloak-rhel9

CPEs

cpe:/a:redhat:build_keycloak:26.2::el9

Default Status

affected

Versions

Unaffected

From 26.2-4 before * (rpm)

Vendor

Red Hat, Inc.

Product

Red Hat build of Keycloak 26.2

Collection URL

https://catalog.redhat.com/software/containers/

Package Name

rhbk/keycloak-rhel9-operator

CPEs

cpe:/a:redhat:build_keycloak:26.2::el9

Default Status

affected

Versions

Unaffected

From 26.2-4 before * (rpm)

Vendor

Red Hat, Inc.

Product

Red Hat Single Sign-On 7

Collection URL

https://access.redhat.com/downloads/content/package-browser/

Package Name

rh-sso7-keycloak

CPEs

cpe:/a:redhat:red_hat_single_sign_on:7

Default Status

unaffected

Problem Types

Type	CWE ID	Description
CWE	CWE-297	Improper Validation of Certificate with Host Mismatch

Type: CWE

CWE ID: CWE-297

Description: Improper Validation of Certificate with Host Mismatch

Metrics

Version	Base score	Base severity	Vector
3.1	8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Version: 3.1

Base score: 8.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Metrics Other Info

Red Hat severity rating

value:

Important

namespace:

https://access.redhat.com/security/updates/classification/

Workarounds

Use the correct TLS configuration and avoid using "--tls-hostname-verifier=any".

Timeline

Event	Date
Reported to Red Hat.	2025-04-10 12:24:28
Made public.	2025-04-29 00:00:00

Event: Reported to Red Hat.

Date: 2025-04-10 12:24:28

Event: Made public.

Date: 2025-04-29 00:00:00

References

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2025:4335	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:4336	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8672	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8690	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-3501	vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2358834	issue-tracking x_refsource_REDHAT
https://github.com/keycloak/keycloak/issues/39350	N/A
https://github.com/keycloak/keycloak/pull/39366	N/A

Hyperlink: https://access.redhat.com/errata/RHSA-2025:4335

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2025:4336

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2025:8672

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2025:8690

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/security/cve/CVE-2025-3501

Resource:

vdb-entry

x_refsource_REDHAT

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2358834

Resource:

issue-tracking

x_refsource_REDHAT

Hyperlink: https://github.com/keycloak/keycloak/issues/39350

Resource: N/A

Hyperlink: https://github.com/keycloak/keycloak/pull/39366

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

unknown

Unaffected

Unaffected

Unaffected

Unaffected

Unaffected

Unaffected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References