Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.keycloak/keycloak-ldap-federation@26.1.0
Typemaven
Namespaceorg.keycloak
Namekeycloak-ldap-federation
Version26.1.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version26.4.6
Latest_non_vulnerable_version26.4.6
Affected_by_vulnerabilities
0
url VCID-3vxq-nfzs-zugz
vulnerability_id VCID-3vxq-nfzs-zugz
summary 
Duplicate Advisory: Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4hx9-48xh-5mxr. This link is maintained to preserve external references.

### Original Description

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
references
0
reference_url https://access.redhat.com/errata/RHSA-2025:22088
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2025:22088
1
reference_url https://access.redhat.com/errata/RHSA-2025:22089
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2025:22089
2
reference_url https://access.redhat.com/errata/RHSA-2025:22090
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2025:22090
3
reference_url https://access.redhat.com/errata/RHSA-2025:22091
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2025:22091
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2416038
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=2416038
5
reference_url https://github.com/keycloak/keycloak
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak
6
reference_url https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328
7
reference_url https://github.com/keycloak/keycloak/issues/44478
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak/issues/44478
8
reference_url https://github.com/keycloak/keycloak/releases/tag/26.4.6
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak/releases/tag/26.4.6
9
reference_url https://access.redhat.com/security/cve/CVE-2025-13467
reference_id CVE-2025-13467
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/security/cve/CVE-2025-13467
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-13467
reference_id CVE-2025-13467
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-13467
11
reference_url https://github.com/advisories/GHSA-93vm-mqpw-8wh3
reference_id GHSA-93vm-mqpw-8wh3
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-93vm-mqpw-8wh3
fixed_packages
0
url pkg:maven/org.keycloak/keycloak-ldap-federation@26.4.6
purl pkg:maven/org.keycloak/keycloak-ldap-federation@26.4.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-ldap-federation@26.4.6
aliases GHSA-93vm-mqpw-8wh3
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3vxq-nfzs-zugz
1
url VCID-wg6h-c3vm-n7h9
vulnerability_id VCID-wg6h-c3vm-n7h9
summary 
Duplicate Advisory: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2p82-5wwr-43cw. This link is maintained to preserve external references.

# Original Description

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.
references
0
reference_url https://access.redhat.com/errata/RHSA-2025:2544
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2025:2544
1
reference_url https://access.redhat.com/errata/RHSA-2025:2545
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2025:2545
2
reference_url https://access.redhat.com/security/cve/CVE-2025-0604
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/security/cve/CVE-2025-0604
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2338993
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=2338993
4
reference_url https://github.com/keycloak/keycloak
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-0604
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-0604
6
reference_url https://github.com/advisories/GHSA-m3hp-8546-5qmr
reference_id GHSA-m3hp-8546-5qmr
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m3hp-8546-5qmr
fixed_packages
0
url pkg:maven/org.keycloak/keycloak-ldap-federation@26.1.1
purl pkg:maven/org.keycloak/keycloak-ldap-federation@26.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3vxq-nfzs-zugz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-ldap-federation@26.1.1
aliases GHSA-m3hp-8546-5qmr
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wg6h-c3vm-n7h9
2
url VCID-yhaz-d3e3-ufb8
vulnerability_id VCID-yhaz-d3e3-ufb8
summary 
Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies.
references
0
reference_url https://access.redhat.com/errata/RHSA-2025:2545
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-22T15:05:55Z/
url https://access.redhat.com/errata/RHSA-2025:2545
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0604.json
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0604.json
2
reference_url https://access.redhat.com/security/cve/CVE-2025-0604
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-22T15:05:55Z/
url https://access.redhat.com/security/cve/CVE-2025-0604
3
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-0604
reference_id
reference_type
scores
0
value 0.00041
scoring_system epss
scoring_elements 0.12438
published_at 2026-04-18T12:55:00Z
1
value 0.00046
scoring_system epss
scoring_elements 0.14133
published_at 2026-04-21T12:55:00Z
2
value 0.00059
scoring_system epss
scoring_elements 0.18402
published_at 2026-04-12T12:55:00Z
3
value 0.00059
scoring_system epss
scoring_elements 0.18295
published_at 2026-04-16T12:55:00Z
4
value 0.00059
scoring_system epss
scoring_elements 0.18607
published_at 2026-04-04T12:55:00Z
5
value 0.00059
scoring_system epss
scoring_elements 0.18351
published_at 2026-04-13T12:55:00Z
6
value 0.00059
scoring_system epss
scoring_elements 0.18316
published_at 2026-04-07T12:55:00Z
7
value 0.00059
scoring_system epss
scoring_elements 0.18398
published_at 2026-04-08T12:55:00Z
8
value 0.00059
scoring_system epss
scoring_elements 0.1845
published_at 2026-04-11T12:55:00Z
9
value 0.00059
scoring_system epss
scoring_elements 0.18552
published_at 2026-04-02T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-0604
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2338993
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-22T15:05:55Z/
url https://bugzilla.redhat.com/show_bug.cgi?id=2338993
5
reference_url https://github.com/keycloak/keycloak
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak
6
reference_url https://github.com/keycloak/keycloak/security/advisories/GHSA-2p82-5wwr-43cw
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak/security/advisories/GHSA-2p82-5wwr-43cw
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-0604
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-0604
8
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26
reference_id cpe:/a:redhat:build_keycloak:26
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26
9
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26.0::el9
reference_id cpe:/a:redhat:build_keycloak:26.0::el9
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26.0::el9
10
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7
reference_id cpe:/a:redhat:red_hat_single_sign_on:7
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7
11
reference_url https://github.com/advisories/GHSA-2p82-5wwr-43cw
reference_id GHSA-2p82-5wwr-43cw
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2p82-5wwr-43cw
fixed_packages
0
url pkg:maven/org.keycloak/keycloak-ldap-federation@26.1.3
purl pkg:maven/org.keycloak/keycloak-ldap-federation@26.1.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3vxq-nfzs-zugz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-ldap-federation@26.1.3
aliases CVE-2025-0604, GHSA-2p82-5wwr-43cw
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-yhaz-d3e3-ufb8
Fixing_vulnerabilities
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-ldap-federation@26.1.0