CVE-2025-11537

🗓️ 10 Feb 2026 11:16:09Reported by [email protected]Type

Keycloak logging exposes Authorization and Cookie data, enabling credential theft and compromise.

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2025-11537	10 Feb 202610:53	–	attackerkb
Chainguard	CVE-2025-11537 vulnerabilities	9 Apr 202613:18	–	cgr
CNNVD	Keycloak 安全漏洞	10 Feb 202600:00	–	cnnvd
CVE	CVE-2025-11537	10 Feb 202610:53	–	cve
Cvelist	CVE-2025-11537 Keycloak-services: sensitive headers shown in the http access logs	10 Feb 202610:53	–	cvelist
Github Security Blog	Keycloak logs sensitive headers	10 Feb 202612:30	–	github
Japan Vulnerability Notes	Multiple Vulnerabilities in Hitachi Ops Center Common Services	5 Aug 202601:11	–	jvn
OSV	CGA-X59G-8HJ7-JW6M	9 Apr 202610:45	–	osv
OSV	CLEANSTART-2026-BA48144 Security fixes in keycloak 26.5.7-r5	30 Jul 202607:10	–	osv
OSV	ECHO-1EC0-58D1-CB3D Keycloak's GHSA advisory (GHSA-gv3v-2cpp-3pmq) lists the affected package/range as org.keycloak:keycloak-quarkus-server < 26.5.6 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerable mechanism is the HTTP access log feature (config.HttpAccessLogOptions, HttpAccessLogPropertyMappers) added by the fix commit's PR to mask Authorization/Cookie headers in a verbose access-log pattern. That feature does not exist in 25.0.6 at all — confirmed via a full source search (no HttpAccessLogOptions.java, HttpAccessLogPropertyMappers.java, or any http-access-log config option anywhere in quarkus/config-api or quarkus/runtime). There is no access-log-pattern mechanism in this version capable of the described header disclosure.	30 Aug 202616:45	–	osv