GHSA-GV3V-2CPP-3PMQ Keycloak logs sensitive headers

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

org.keycloak:keycloak-quarkus-server-app (12.0.4), org.keycloak:keycloak-quarkus-server-deployment (12.0.4) potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (12.0.4)

org.keycloak:keycloak-quarkus-server MAVEN version 12.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-quarkus-server-app 12.0.4 -...

org.keycloak:keycloak-guides (19.0.1), org.keycloak:keycloak-guides-maven-plugin (19.0.1) +3 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (19.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version 19.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 19.0.1 - org.keycloak:keycloak-guides-maven-plugin 19.0.1...

io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0, <=0.2.0), org.keycloak:keycloak-guides (21.0.1) +4 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (21.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics =0.1.0, =0.2.0 - org.keycloak:keycloak-guide...

org.keycloak:keycloak-guides (24.0.1), org.keycloak:keycloak-guides-maven-plugin (24.0.1) +3 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (24.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version 24.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 24.0.1 - org.keycloak:keycloak-guides-maven-plugin 24.0.1...

org.keycloak:keycloak-guides (24.0.5), org.keycloak:keycloak-guides-maven-plugin (24.0.5) +3 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (24.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version 24.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 24.0.5 - org.keycloak:keycloak-guides-maven-plugin 24.0.5...

org.keycloak:keycloak-guides (20.0.5), org.keycloak:keycloak-guides-maven-plugin (20.0.5) +3 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (20.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version 20.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 20.0.5 - org.keycloak:keycloak-guides-maven-plugin 20.0.5...

org.keycloak:keycloak-guides (18.0.2), org.keycloak:keycloak-guides-maven-plugin (18.0.2) +3 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (18.0.2)

org.keycloak:keycloak-quarkus-server MAVEN version 18.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 18.0.2 - org.keycloak:keycloak-guides-maven-plugin 18.0.2...

CVE-2025-11537

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

CVE-2025-11537

In CVE-2025-11537, a flaw in Keycloak causes sensitive headers (Authorization and Cookie) to be logged when the logging format uses verbose templates (e.g., the predefined 'long' pattern). An attacker with read access to log files can extract credentials (bearer tokens, session cookies) and imper...

CVE-2025-11537 Keycloak-services: sensitive headers shown in the http access logs

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

CVE-2025-11537 Keycloak-services: sensitive headers shown in the http access logs

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

CVE-2025-11537

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability. This vulnerability arises when the log format is configured to include details for users, causing sensitive headers to be disclosed in plain text within the logs. This...

PT-2026-7261

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak where sensitive headers, including Authorization and Cookie, are disclosed in cleartext within log files when a verbose, user-supplied logging format—such as the...

CVE-2025-11537: Improper Output Neutralization for Logs

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

org.keycloak:keycloak-account-freemarker (1.1.0.beta1), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta1) +1 more potentially affected by CVE-2026-1529 via org.keycloak:keycloak-services (1.1.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta1 -...

org.keycloak:keycloak-account-freemarker (1.4.0.final), org.keycloak:keycloak-broker-oidc (1.4.0.final) +8 more potentially affected by CVE-2026-1529 via org.keycloak:keycloak-services (1.4.0.final)

org.keycloak:keycloak-services MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.4.0.final - org.keycloak:keycloak-broker-oidc...

com.github.vzakharchenko:keycloak-plugins (1.0.2), com.github.vzakharchenko:mikrotik-radius-plugin (1.0.2) +12 more potentially affected by CVE-2026-1529 via org.keycloak:keycloak-services (8.0.2)

org.keycloak:keycloak-services MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.0.2 - com.github.vzakharchenko:mikrotik-radius-plugin...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (4.0.2-25.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (4.0.2-25.0) +22 more potentially affected by CVE-2026-1529 via org.keycloak:keycloak-services (25.0.4)

org.keycloak:keycloak-services MAVEN version 25.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension 4.0.2-25.0 -...