CVE-2025-0604Keycloak password reset skips re-validation against AD
What broke
Keycloak's password-reset flow did not re-validate the user against Active Directory. An account that AD had expired or disabled could still complete reset and sign in through Keycloak. Red Hat patched.
Why it matters
Federation only works if the source of truth is consulted at every privileged step. A reset that trusts a stale Keycloak user object is how leavers and disabled contractors come back. This is a joiner-mover-leaver bug, not a crypto bug.
What to do
- Upgrade Keycloak.
- On every reset, require a live LDAP/AD bind or a fresh User Federation lookup.
- Hunt for successful resets on accounts that AD shows as disabled.
After you patch
Patching closes the entry point. It does not remove access an attacker established through it.
- Revoke sessions and API tokens on the affected system rather than only resetting passwords.
- Audit accounts, tokens, and administrative changes made during the exposure window.
- Rotate credentials the system stored or could reach, including directory service accounts and integration keys. See secrets rotation.
- Treat the system as a pivot: whatever it could authenticate to is in scope until you have checked it.
Sources
Related identity CVEs
Related on Start with Identity
- CVEKeycloak reset-credentials flow skips the email token, full account takeover
Improper state validation in Keycloak's reset-credentials authentication flow let an unauthenticated attacker jump straight to the password-update step, no emai
- CVEKeycloak accepts SAML from a disabled identity provider
A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a cont
- CVEKeycloak Admin API auth bypass to custom attributes
Keycloak's Admin API let a caller read sensitive custom attributes they should not have seen (CWE-266). An authorization hole on the admin plane.
- BlogResetNightmare: a low-priv UPN write can reset a Domain Admin via Kerberos kpasswd
CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- Comparisonfusionauth-vs-keycloak
FusionAuth and Keycloak are the two names that dominate the self-hosted identity conversation, but they sit on opposite sides of the open-source line. Keycloak