CVE-2025-1391

MEDIUM EPSS 29.4%

Published Feb 17, 20251y ago · Modified Jun 17, 20261w ago

5.4 CVSS 3.1

Medium

Published Feb 17, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.

CVSS Details

Base Score

5.4

Exploitability

2.8

Impact

2.5

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

29.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-284

References 6

access.redhat.com https://access.redhat.com/errata/RHSA-2025:2544
access.redhat.com https://access.redhat.com/errata/RHSA-2025:2545
access.redhat.com https://access.redhat.com/security/cve/CVE-2025-1391
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2346082
github.com https://github.com/keycloak/keycloak/issues/37169
github.com https://github.com/keycloak/keycloak/pull/37235

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.