Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration. Mitigation Disable LDAP referrals in all LDAP user providers in all realms...

org.keycloak:keycloak-dependencies-server-all (19.0.2), org.keycloak:keycloak-guides (19.0.2) +8 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (19.0.2)

org.keycloak:keycloak-ldap-federation MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 19.0.2 - org.keycloak:keycloak-guides...

org.keycloak:keycloak-dependencies-server-all (10.0.0), org.keycloak:keycloak-server-feature-pack (10.0.0) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (10.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 10.0.0 -...

org.keycloak:keycloak-dependencies-server-all (3.3.0.final), org.keycloak:keycloak-server-feature-pack (3.3.0.final) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (3.3.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 3.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.3.0.final -...

org.keycloak:keycloak-dependencies-server-all (2.5.0.final), org.keycloak:keycloak-services (2.5.0.final) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (2.5.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 2.5.0.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.5.final) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (1.9.5.final)

org.keycloak:keycloak-ldap-federation MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.5.final Source cves:...

org.keycloak:keycloak-services (4.8.0.final) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (4.8.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 4.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-services 4.8.0.final Source cves: CVE-2025-13467 Source...

org.keycloak:keycloak-dependencies-server-all (9.0.0), org.keycloak:keycloak-server-feature-pack (9.0.0) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (9.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 9.0.0 -...

org.javaloong.kongmink.keycloak:keycloak-embedded-server (1.1.0), org.keycloak:keycloak-dependencies-server-all (19.0.3) +9 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (19.0.3)

org.keycloak:keycloak-ldap-federation MAVEN version 19.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.javaloong.kongmink.keycloak:keycloak-embedded-server 1.1.0 -...

org.keycloak:keycloak-dependencies-server-all (3.4.0.final), org.keycloak:keycloak-server-feature-pack (3.4.0.final) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (3.4.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 3.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.4.0.final -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.12, <=1.3.14), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.12, <=1.3.14) +16 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (15.0.2)

org.keycloak:keycloak-ldap-federation MAVEN version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.12, =1.3.12, =1.3.12, =1.3.12...

org.keycloak:keycloak-dependencies-server-all (1.8.1.final) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (1.8.1.final)

org.keycloak:keycloak-ldap-federation MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.8.1.final Source cves:...

io.phasetwo.keycloak:keycloak-orgs (>=0.24, <=0.27), org.keycloak:keycloak-dependencies-server-all (21.0.2) +7 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (21.0.2)

org.keycloak:keycloak-ldap-federation MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - io.phasetwo.keycloak:keycloak-orgs =0.24, =0.27 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.17, <=1.3.18), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.17, <=1.3.18) +16 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (16.1.0)

org.keycloak:keycloak-ldap-federation MAVEN version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.17, =1.3.17, =1.3.17, =1.3.17...

org.keycloak:keycloak-services (4.0.0.beta3) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (4.0.0.beta3)

org.keycloak:keycloak-ldap-federation MAVEN version 4.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-services 4.0.0.beta3 Source cves: CVE-2025-13467 Source...

org.keycloak:keycloak-dependencies-server-all (5.0.0), org.keycloak:keycloak-server-feature-pack (5.0.0) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (5.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 5.0.0 -...

org.keycloak:keycloak-dependencies-server-all (20.0.4), org.keycloak:keycloak-guides (20.0.4) +5 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (20.0.4)

org.keycloak:keycloak-ldap-federation MAVEN version 20.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 20.0.4 - org.keycloak:keycloak-guides...

org.keycloak:keycloak-dependencies-server-all (1.3.1.final) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (1.3.1.final)

org.keycloak:keycloak-ldap-federation MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.3.1.final Source cves:...

org.keycloak:keycloak-dependencies-server-all (2.1.0.final) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (2.1.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 2.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 2.1.0.final Source cves:...

org.keycloak:keycloak-dependencies-server-all (7.0.1), org.keycloak:keycloak-server-feature-pack (7.0.1) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (7.0.1)

org.keycloak:keycloak-ldap-federation MAVEN version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 7.0.1 -...