CVE-2025-3501: Org.keycloak.protocol.services: keycloak hostname verification
A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.
Other sources
A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate verification is skipped, which is unintended.
— GitHub
Hostname verification issue that causes the trust store to trust all certificates. By setting the verification policy to 'ALL' not only the hostname check is skipped, but also the trust store certificate verification, which is an unintended side effect.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3501?
CVE-2025-3501 has been rated as a critical severity vulnerability due to its potential to allow unauthorized access.
How do I fix CVE-2025-3501?
To fix CVE-2025-3501, upgrade to Keycloak version 26.2.2 or later.
What causes CVE-2025-3501?
CVE-2025-3501 is caused by a flaw in Keycloak where setting a verification policy to 'ALL' skips the trust store certificate verification.
What are the risks associated with CVE-2025-3501?
The risks associated with CVE-2025-3501 include the ability for attackers to impersonate trusted services by exploiting weak certificate validation.
Is CVE-2025-3501 present in all Keycloak versions?
CVE-2025-3501 affects specific versions of Keycloak prior to the fix provided in version 26.2.2.