CVE-2025-11538 - CVE House
Back to Database
Status published Medium CVE-2025-11538

Keycloak-server: debug default bind address

Vulnerability Description

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-11538

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • This issue was discovered by Steven Hawkins (Red Hat).

References

More from Keycloak

View All →
CVE-2025-9162
Org.keycloak/keycloak-model-storage-service: variable injection into environment variables
Medium 4.9
CVE-2025-8419
Org.keycloak/keycloak-services: keycloak smtp inject vulnerability
Medium 5.3
CVE-2025-13467
Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation
Medium 5.5
CVE-2025-12390
Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
Medium 6
CVE-2025-12150
Org.keycloak/keycloak-services: webauthn attestation statement verification bypass
Low 3.1

Affected Vendor

Affected Software

keycloak, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.4
Vulnerable Versions:
0, 26.4.4-1, 26.4-3

Timeline

Official Publish: November 13th, 2025
Last Modified: December 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-1327

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.