Skip to content
Fencer Vulns
high 7.1

CVE-2025-7365 json

Keycloak: phishing attack via email verification step in first login flow

published 2025-07-10 15 mo ago modified 2026-08-31 2 mo ago also GHSA-xhpr-465j-7p9q , EUVD-2025-20994

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

Patch / fix

  • maven org.keycloak:keycloak-services 26.0.13, 26.2.6
  • Red Hat Red Hat build of Keycloak 26.0 26.0-16, 26.0-17, 26.0.13-2
  • Red Hat Red Hat build of Keycloak 26.2 26.2-6, 26.2.6-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-7365 updated cvss 7.1

keycloak: Phishing attack via email verification step in first login flow

  • Red Hat build of Keycloak 26
    fixed: vendor fix “Disable account review in the Identity Provider to prevent users from potentially modifying identity information. Disable the email verification step and use only re-authentication step.” RHSA-2025:11987
  • Red Hat build of Keycloak 26.0 rhbk/keycloak-rhel9 26.0-16, rhbk/keycloak-rhel9-operator 26.0-17, rhbk/keycloak-operator-bundle 26.0.13-2
    fixed: vendor fix “Disable account review in the Identity Provider to prevent users from potentially modifying identity information. Disable the email verification step and use only re-authentication step.” RHSA-2025:11986
  • Red Hat build of Keycloak 26.2 rhbk/keycloak-rhel9 26.2-6, rhbk/keycloak-rhel9-operator 26.2-6, rhbk/keycloak-operator-bundle 26.2.6-1
    fixed: vendor fix “Disable account review in the Identity Provider to prevent users from potentially modifying identity information. Disable the email verification step and use only re-authentication step.” RHSA-2025:12016

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.keycloak:keycloak-services
<26.0.13
>=26.2.0, <26.2.6
26.0.13
26.2.6

Affected products

  • Red Hat Red Hat build of Keycloak 26
  • Red Hat Red Hat build of Keycloak 26.0
  • Red Hat Red Hat build of Keycloak 26.2

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.