CVE-2025-11538
Keycloak-server: debug default bind address
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
| CWE | CWE-1327 |
| Vendor | keycloak |
| Product | keycloak |
| Published | Nov 13, 2025 |
| Last Updated | Dec 19, 2025 |
Stay Ahead of the Next One
Get instant alerts for keycloak keycloak
Be the first to know when new medium vulnerabilities affecting keycloak keycloak are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
Keycloak / keycloak
0 < 26.4.4
Red Hat / Red Hat build of Keycloak 26.4
All versions affected Red Hat / Red Hat build of Keycloak 26.4
All versions affected Red Hat / Red Hat build of Keycloak 26.4
All versions affected Red Hat / Red Hat build of Keycloak 26.4.4
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2025:21370 access.redhat.com: https://access.redhat.com/errata/RHSA-2025:21371 access.redhat.com: https://access.redhat.com/security/cve/CVE-2025-11538 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2402622 github.com: https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9 github.com: https://github.com/keycloak/keycloak/pull/43574
Credits
This issue was discovered by Steven Hawkins (Red Hat).