CVEvulnerability
CVE-2025-11538
6.8 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2025-11-13
- Last modified
- 2026-10-18
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.8 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-1327
Description
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
Related
Weakness · CWE (1)
- CWE-1327 Binding to an Unrestricted IP Address weakness
References
- https://access.redhat.com/errata/RHSA-2025:21370 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:21371 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2025-11538 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2402622 bugzilla.redhat.com
- https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9 github.com
- https://github.com/keycloak/keycloak/pull/43574 github.com