Thanks to visit codestin.com
Credit goes to github.com

Skip to content

CVE-2025-13467 Deserialization of untrusted data in ldap user federation #44478

New issue
New issue
Closed
cve
Closed
CVE-2025-13467 Deserialization of untrusted data in ldap user federation#44478
cve
Labels
kind/cveIssues identified as CVEs on third-party dependencies, or issues which Keycloak is not affectedrelease/26.2.11release/26.4.6
@stianst

Description

@stianst
stianst
opened on Nov 25, 2025

Description

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/cveIssues identified as CVEs on third-party dependencies, or issues which Keycloak is not affectedrelease/26.2.11release/26.4.6

    Type

    cve

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions