GitHub Advisoryadvisory · Maven
GHSA-gv3v-2cpp-3pmq Keycloak logs sensitive headers
MEDIUM
Official page ↗
- Aliases
- CVE-2025-11537
- Ecosystem
- Maven
- Packages
- org.keycloak:keycloak-quarkus-server
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-117
- Reviewed
- 2026-02-11
Affected packages
• Maven org.keycloak:keycloak-quarkus-server: < 26.5.6 → fixed in 26.5.6
Description
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.
Patches are available, see:
• https://github.com/keycloak/keycloak/releases/tag/26.4.11
• https://github.com/keycloak/keycloak/releases/tag/26.5.6
• https://github.com/keycloak/keycloak/releases/tag/26.6.0
Related
Alias · CVE (1)
- CVE-2025-11537 A flaw was found in Keycloak. vulnerability
Weakness · CWE (1)
- CWE-117 Improper Output Neutralization for Logs weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-11537 advisory
- https://github.com/keycloak/keycloak/commit/137a35c1109ff43a305f26264978a3ea21452373 web
- https://github.com/keycloak/keycloak/commit/5a3cdb7c4ccbf83ffc926f70d655a60269d7207b web
- https://github.com/keycloak/keycloak/commit/9622f550a6e565b29a3a37454421f08626791a6c web
- https://access.redhat.com/errata/RHEA-2025:19385 web
- https://access.redhat.com/errata/RHEA-2025:19386 web
- https://access.redhat.com/security/cve/CVE-2025-11537 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2402616 web
- https://github.com/keycloak/keycloak package
- https://www.keycloak.org/server/logging#_change_log_formatpattern web