7.1

CVE-2025-7365: redhat keycloak Origin Validation Error

CVSS: 7.1v3.1HighModified
AliasesCGA-62rq-732f-6rprCGA-cc43-ph56-w6w7CGA-h45w-42rw-428v
Published 10-07-2025Last modified 31-08-2026
Open JSON

Vulnerability summary

CVE-2025-7365 is a high (CVSS 7.1) Origin Validation Error vulnerability in redhat keycloak. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.6% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.27%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-23Q9-PH83-M7JV

Timeline

  1. 10-07-2025
    PublishedVulnerability first disclosed.
  2. 31-08-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

+0.02 pp

From 0.25% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • keycloak-26.2All versions (No fix recorded) | < 26.2.5-r6
  • keycloak-26.2-iamguarded-compatAll versions (No fix recorded)
  • keycloak-fips-26.2-iamguarded-fipsAll versions (No fix recorded)
Org.keycloak1 product
  • keycloak-services< 26.0.13 | ≥ 26.2.0, < 26.2.6
Redhat1 product

3 vendors · 5 products

References

18 links
Show all 18 references