5.5
Medium
CVE-2025-13467 A flaw was found in the Keycloak LDAP User Federation provider
Description
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak 26.4 | earliest → < 26.4.6 | 26.4.6 |
| Red Hat build of Keycloak 26.2 26.2 | earliest → < 26.2-12 | 26.2-12 |
| Red Hat build of Keycloak 26.2.11 | Versions not published | |
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-5 | 26.4-5 |
| Red Hat build of Keycloak 26.4.6 | Versions not published |
Other CVEs of keycloak
The 15 CVEs of keycloak →
CVE-2026-90997
A flaw was found in Keycloak
7.4
High
CVE-2026-1609
A flaw was found in Keycloak
8.1
High
CVE-2025-12150
A flaw was found in Keycloak’s WebAuthn registration component
3.1
Low
CVE-2025-11538
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…
6.8
Medium