Vulnerability in Keycloak
CVE-2025-8419
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
Vulnerability class: CRLF Injection
EPSS: 0.004 (33.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Keycloak — versions 0
- Red Hat Build Of Keycloak 26.0 — versions 26.0.15-1, 26.0-18, 26.0-19
- Red Hat Build Of Keycloak 26.2 — versions 26.2.8-1, 26.2-8
- Redhat Keycloak
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-8419?
- CVE-2025-8419 is a medium-severity vulnerability in Keycloak, classified under CRLF Injection. CVSS score: 5.3/10. Published 2025-08-06.
- How severe is CVE-2025-8419?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2025-8419 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.