CVE-2025-8419 - CVE House
Back to Database
Status published Medium CVE-2025-8419

Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

Vulnerability Description

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-8419

Credits & Attribution

No credits recorded in the NVD database.

References

More from Keycloak

View All →
CVE-2025-9162
Org.keycloak/keycloak-model-storage-service: variable injection into environment variables
Medium 4.9
CVE-2025-13467
Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation
Medium 5.5
CVE-2025-12390
Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
Medium 6
CVE-2025-12150
Org.keycloak/keycloak-services: webauthn attestation statement verification bypass
Low 3.1
CVE-2025-12110
Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed
Medium 5.4

Affected Vendor

Affected Software

keycloak, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.2
Vulnerable Versions:
0, 26.0.15-1, 26.0-18, 26.0-19, 26.2.8-1, 26.2-8

Timeline

Official Publish: August 6th, 2025
Last Modified: January 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-93

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.