GHSA-9342-92GG-6V29 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, keycloak, apicurio-registry, jenkins, wildfly, thingsboard, dependency-track, apache-nifi, sonarqube...

GHSA-9342-92GG-6V29 vulnerabilities

Vulnerabilities for packages: jenkins, commercial-elasticsearch, sonarqube, thingsboard, elasticsearch, wildfly, apache-nifi, keycloak, dependency-track, apicurio-registry, keycloak-config-cli, geoserver, elasticsearch-fips...

CVE-2025-7962 vulnerabilities

Vulnerabilities for packages: jenkins, commercial-elasticsearch, sonarqube, thingsboard, elasticsearch, wildfly, apache-nifi, keycloak, dependency-track, apicurio-registry, keycloak-config-cli, geoserver, elasticsearch-fips...

Keycloak <= 26.3.2 SMTP Inject (GHSA-qj5r-2r5p-phc7)

The version of Keycloak installed on the remote host is prior or equal to 26.3.2. It is, therefore, affected by SMTP inject vulnerability as reference in GHSA-qj5r-2r5p-phc7 advisory. - A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform...

Keycloak SMTP Arbitrary Command Execution

The vulnerability of the SMTP protocol implementation for managing identities and access control in Keycloak relates to the failure to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CRLF Injection

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to CRLF Injection during the e-mail registration. An attacker can cause the system to send unsolicited emails...

GHSA-QJ5R-2R5P-PHC7 Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP...

Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP...

CRLF Injection

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to CRLF Injection during the e-mail registration. An attacker can cause the system to send unsolicited...

CVE-2025-8419

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject...

CVE-2025-8419

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject...

CVE-2025-8419 Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +189 more potentially affected by CVE-2025-8419 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.3.2)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =1.4.11 - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak 24.3.0.0 and more Source cves: CVE-2025-8419 Source advisory:...

CVE-2025-8419

CVE-2025-8419 : A Keycloak SMTP injection vulnerability exists in Keycloak-services where special characters in the local-part of an email during registration can trigger SMTP injection, potentially causing the server to send unsolicited emails. The issue is limited to short emails (local part ca...

CVE-2025-8419 Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject...

CVE-2025-8419 Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject...

CVE-2025-8419

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject...

CVE-2025-8419: Improper Neutralization of CRLF Sequences

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters limited local part of the email, so the attack is limited to very shorts emails subject...

PT-2025-32199

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak-services where special characters used during email registration may allow SMTP Injection, resulting in the sending of unsolicited emails from the Keycloak server...

Keycloak 注入漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an injection vulnerability that stems from the fact that the use of special characters during the email registration process could lead to SMTP injection, sending unsolicited short...