Org.keycloak.protocol.services: keycloak hostname verification

Description

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.

Timeline

Scores

EPSS (exploitation in 30 days)

0.47% · top 59% of all CVEs (11 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.

Affected products

• keycloak

  • affected 25.0.0 – < 25.*
  • affected 26.0.0 – < 26.0.11
  • unknown 26.1.0 – < 26.1.*
  • affected 26.2.0 – < 26.2.2

• Red Hat · Red Hat Build of Keycloak

  All versions: unaffected

• Red Hat · Red Hat build of Keycloak 26

  All versions: unaffected

• Red Hat · Red Hat build of Keycloak 26.0

  • unaffected 26.0.11-2 – < *

• Red Hat · Red Hat build of Keycloak 26.0

  • unaffected 26.0-12 – < *

• Red Hat · Red Hat build of Keycloak 26.0

  • unaffected 26.0-13 – < *

• Red Hat · Red Hat build of Keycloak 26.2

  • unaffected 26.2.5-1 – < *

• Red Hat · Red Hat build of Keycloak 26.2

  • unaffected 26.2-4 – < *

• Red Hat · Red Hat build of Keycloak 26.2

  • unaffected 26.2-4 – < *

• Red Hat · Red Hat Single Sign-On 7

  All versions: unaffected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.keycloak:keycloak-servicesGHSA-hw58-3793-42gg (opens in a new tab)

What to do

Workaround: Use the correct TLS configuration and avoid using "--tls-hostname-verifier=any".

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2025-12660 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-hw58-3793-42gg (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-3501](https://cveledger.app/badge/CVE-2025-3501.svg)](https://cveledger.app/cve/CVE-2025-3501)

Record last updated 21 Sept 2026, 05:27 UTC.