Medium severity · published Nov 13, 2025
CVE-2025-11538
Keycloak-server: debug default bind address
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat build of Keycloak 26.4 · Red Hat
All versions, or not specified · source: vendor
KE
keycloak · Keycloak
before 26.4.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11538
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11538
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:21370
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:21371
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-11538
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2402622
github.com
https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9
github.com
https://github.com/keycloak/keycloak/pull/43574
More from keycloak
8.8
CVE-2017-12161
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request
8.8
CVE-2014-3709
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF)…
8.1
CVE-2026-1609
Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
7.5
CVE-2014-3651
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR…
7.5
CVE-2017-12159
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session