6.8

GHSA-7M9G-PMXF-M9M8: keycloak-quarkus-server Maven

CVSS: 6.8v3.1MediumPublished
Published 13-11-2025Last modified 10-09-2026
Open JSON

Vulnerability summary

GHSA-7M9G-PMXF-M9M8 is a medium (CVSS 6.8) vulnerability in keycloak-quarkus-server Maven.

Overall risk
27/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.8/10
010
Medium · v3.1 (OSV · Maven), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
CVE-2025-11538CGA-VQ3H-GF7Q-RQ8P

Timeline

  1. 13-11-2025
    PublishedVulnerability first disclosed.
  2. 10-09-2026
    Last modifiedVulnerability information updated.

Description

Duplicate Advisory: Keycloak allows Binding to an Unrestricted IP Address ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references. ### Original Description A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Org.keycloak1 product
  • keycloak-quarkus-server≤ 26.4.4

1 vendor · 1 product

References

8 links