Keycloak Org Mapper Misassigns Org via Username/Email Pattern (CVE-2025-1391)
CVE-2025-1391 Published on February 17, 2025
Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organizations domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
Vulnerability Analysis
CVE-2025-1391 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2025-1391 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2025-1391
stack.watch emails you whenever new vulnerabilities are published in Red Hat Keycloak or Red Hat Build Keycloak. Just hit a watch button to start following.
