Keycloak org.keycloak.auth bypass of required actions (2FA)
CVE-2025-3910 Published on April 29, 2025
Org.keycloak.authentication: two factor authentication bypass
A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
Vulnerability Analysis
CVE-2025-3910 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 6 days later.
Weakness Type
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2025-3910 has been classified to as an authentification vulnerability or weakness.
Products Associated with CVE-2025-3910
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
Vulnerable Packages
The following package name and versions may be associated with CVE-2025-3910
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| maven | org.keycloak:keycloak-services | < 26.2.2 | 26.2.2 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.