Search for vulnerabilities
Vulnerability details: VCID-5s6v-un5w-qyg4
Vulnerability ID VCID-5s6v-un5w-qyg4
Aliases GHSA-gj52-35xm-gxjh
Summary Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xhpr-465j-7p9q. This link is maintained to preserve external references. ### Original Description A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-346 Origin Validation Error
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2025:11986
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:11986
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2025:11987
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:11987
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2025:12015
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:12015
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2025:12016
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:12016
cvssv3.1 5.4 https://access.redhat.com/security/cve/CVE-2025-7365
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2025-7365
cvssv3.1 5.4 https://bugzilla.redhat.com/show_bug.cgi?id=2378852
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2378852
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-gj52-35xm-gxjh
cvssv3.1 5.4 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 5.4 https://github.com/keycloak/keycloak/issues/40446
generic_textual MODERATE https://github.com/keycloak/keycloak/issues/40446
cvssv3.1 5.4 https://github.com/keycloak/keycloak/pull/40520
generic_textual MODERATE https://github.com/keycloak/keycloak/pull/40520
cvssv3.1 5.4 https://github.com/keycloak/keycloak/releases/tag/26.3.0
generic_textual MODERATE https://github.com/keycloak/keycloak/releases/tag/26.3.0
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2025-7365
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-7365
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2025:11986
https://access.redhat.com/errata/RHSA-2025:11987
https://access.redhat.com/errata/RHSA-2025:12015
https://access.redhat.com/errata/RHSA-2025:12016
https://access.redhat.com/security/cve/CVE-2025-7365
https://bugzilla.redhat.com/show_bug.cgi?id=2378852
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/issues/40446
https://github.com/keycloak/keycloak/pull/40520
https://github.com/keycloak/keycloak/releases/tag/26.3.0
https://nvd.nist.gov/vuln/detail/CVE-2025-7365
GHSA-gj52-35xm-gxjh https://github.com/advisories/GHSA-gj52-35xm-gxjh
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2025:11986
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2025:11987
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2025:12015
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2025:12016
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://access.redhat.com/security/cve/CVE-2025-7365
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2378852
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/keycloak/keycloak/issues/40446
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/keycloak/keycloak/pull/40520
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/keycloak/keycloak/releases/tag/26.3.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-7365
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2025-07-31T08:38:46.283134+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-gj52-35xm-gxjh/GHSA-gj52-35xm-gxjh.json 37.0.0