{"id":"CVE-2025-13467","summary":"Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation","details":"A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.","aliases":["GHSA-4hx9-48xh-5mxr"],"modified":"2026-08-12T14:52:26.232894Z","published":"2025-11-25T16:02:21.105Z","related":["CGA-2879-wm7q-q8gh"],"database_specific":{"cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13467.json","cna_assigner":"redhat"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://catalog.redhat.com/software/containers/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:22088"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:22089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:22090"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:22091"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-13467"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13467.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13467"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2416038"},{"type":"REPORT","url":"https://github.com/keycloak/keycloak/issues/44478"},{"type":"FIX","url":"https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328"},{"type":"PACKAGE","url":"https://github.com/keycloak/keycloak"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/keycloak/keycloak","events":[{"introduced":"0"},{"fixed":"754c070cf8ca187dcc71f0f72ff3130ff2195328"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"26.4.6"}]}}],"versions":["2.4.0.Test","1.3.0.Final","1.1.0.Beta2","1.0.0.Final","1.0-final","1.0-rc-1","1.0-beta-4","1.0-beta-2","1.0-beta-1","1.0-alpha-3","1.0-alpha-2","1.0-alpha-1","1.0-alpha-1-12062013"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13467.json","vanir_signatures_modified":"2026-08-12T14:52:26Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328","target":{"file":"quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ImportDistTest.java"},"deprecated":false,"digest":{"line_hashes":["226235308159131851192318270987014224322","201123752110399804826457348981442872527","277947511401556881743486945915696833281","314121494340710425176190798229851943124"],"threshold":0.9},"id":"CVE-2025-13467-00e145f3","signature_type":"Line"},{"target":{"file":"federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java"},"deprecated":false,"digest":{"line_hashes":["40398188417863947483597210405223350405","207837723013471709417959151674516298491","297055932567236312451873712303201226337","2055942045045077661354064933037380652","338172461787905585055078578361784929978","150866136996957221996208880364248988091","66151956964563879737332083771947930455","304562412793772218486372453955314846137","238803037743001507279508068593684431171","153000277485518232007004712568288878969","227319802484199552569462492995153360851","98157415451938275303621989990213152275","206216130834885469245489613711554680353","316947118513604913264988312150837581454","23017492410120117755662122516922765344","231914203594870927130042912037727631486","267569387783300477076953363022469914164"],"threshold":0.9},"id":"CVE-2025-13467-ba0c2ac6","signature_type":"Line","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328","target":{"function":"init","file":"federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java"},"deprecated":false,"digest":{"length":219,"function_hash":"178036485911923954374153240908751077573"},"id":"CVE-2025-13467-eb958976"},{"id":"CVE-2025-13467-fa00f927","signature_type":"Function","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/754c070cf8ca187dcc71f0f72ff3130ff2195328","target":{"file":"quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ImportDistTest.java","function":"testImportLargeUserCount"},"deprecated":false,"digest":{"function_hash":"310336063257694373989777957108392210916","length":705}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"}]}