Vulnerability in Keycloak
CVE-2025-8419
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
Vulnerability class: CRLF Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (33.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Keycloak — versions 0
- Red Hat Build Of Keycloak
- Red Hat Build Of Keycloak 26.0 — versions 26.0.15-1, 26.0-18, 26.0-19
- Red Hat Build Of Keycloak 26.2 — versions 26.2.8-1, 26.2-8
- Red Hat Keycloak
Weakness classification (CWE)
Public proof-of-concept exploits
References
- access.redhat.com/errata/RHSA-2025:15336 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:15337 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:15338 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:15339 (vendor-advisory)
- access.redhat.com/security/cve/CVE-2025-8419 (vdb-entry, Vendor Advisory)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-8419?
- CVE-2025-8419 is a medium-severity vulnerability in Keycloak, classified under CRLF Injection. CVSS score: 5.3/10. Published 2025-08-06.
- How severe is CVE-2025-8419?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2025-8419 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.