CVE-2025-11419Keycloak TLS 1.2 renegotiation denial of service
What broke
Keycloak's TLS 1.2 stack could be driven into a renegotiation loop that exhausted the node. Red Hat patched. This is a denial of service, not a login bypass.
Why it matters
An IdP that is down is an identity incident. Password-reset and help-desk social engineering spike immediately, the same lesson as ruby-saml's compression DoS.
What to do
- Upgrade Keycloak. Prefer TLS 1.3 on the load balancer so renegotiation never reaches the app.
- Keep a break-glass local admin that does not depend on the public login path.
After you patch
Patching closes the entry point. It does not remove access an attacker established through it.
- Revoke sessions and API tokens on the affected system rather than only resetting passwords.
- Audit accounts, tokens, and administrative changes made during the exposure window.
- Rotate credentials the system stored or could reach, including directory service accounts and integration keys. See secrets rotation.
- Treat the system as a pivot: whatever it could authenticate to is in scope until you have checked it.
Sources
Related identity CVEs
Related on Start with Identity
- CVEKeycloak accepts SAML from a disabled identity provider
A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a cont
- CVEKeycloak Admin API auth bypass to custom attributes
Keycloak's Admin API let a caller read sensitive custom attributes they should not have seen (CWE-266). An authorization hole on the admin plane.
- CVEKeycloak authorization bypass
Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-20
- GlossarymTLS
Mutual TLS. Both the client and server present and validate X.509 certificates during the TLS handshake. The cryptographic identity binding makes mTLS a strong
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- Comparisonfusionauth-vs-keycloak
FusionAuth and Keycloak are the two names that dominate the self-hosted identity conversation, but they sit on opposite sides of the open-source line. Keycloak