Keycloak Org Mapper Misassigns Org via Username/Email Pattern (CVE-2025-1391)
CVE-2025-1391 Published on February 17, 2025

Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organizations domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.

Github Repository Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2025-1391 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public.

Weakness Type

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2025-1391 has been classified to as an Authorization vulnerability or weakness.


Products Associated with CVE-2025-1391

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-1391 are published in these products:

Red Hat Keycloak
 
Red Hat Build Keycloak
 

Vulnerable Packages

The following package name and versions may be associated with CVE-2025-1391

Package Manager Vulnerable Package Versions Fixed In
maven org.keycloak:keycloak-services >= 26.1.0, < 26.1.3 26.1.3
maven org.keycloak:keycloak-services < 26.0.10 26.0.10

Exploit Probability

EPSS
0.04%
Percentile
12.13%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.