Identity CVE · Other
CVE-2025-0604Keycloak password reset skips re-validation against AD
high
What broke
Keycloak's password-reset flow did not re-validate the user against Active Directory. An account that AD had expired or disabled could still complete reset and sign in through Keycloak. Red Hat patched.
Why it matters
Federation only works if the source of truth is consulted at every privileged step. A reset that trusts a stale Keycloak user object is how leavers and disabled contractors come back. This is a joiner-mover-leaver bug, not a crypto bug.
What to do
- Upgrade Keycloak.
- On every reset, require a live LDAP/AD bind or a fresh User Federation lookup.
- Hunt for successful resets on accounts that AD shows as disabled.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.