CVE-2025-8419VulnerabilityPublished 6 Aug 2025Updated 20 Nov 2025

CVE-2025-8419: Red Hat build of Keycloak 26.0 · CRLF Injection

Affects Red Hat build of Keycloak 26.0Source CVE Database V5

Not known to be exploited · CVSS 6.5 Medium.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.5% chance of exploitation in 30 days – higher than 44% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate CVE-2025-8419, organizations should first monitor Red Hat and Keycloak advisories for official patches and apply them promptly once available. In the interim, implement strict input validation and sanitization on email registration fields to neutralize CRLF sequences and other special characters that could be used for injection. Employ application-layer firewalls or email gateways to detect and block anomalous outbound emails originating from Keycloak servers. Restrict the ability of Keycloak to send emails to only trusted SMTP servers with proper authentication and logging enabled. Conduct regular audits of email logs to identify unusual patterns or volumes of outgoing mail. Consider deploying rate limiting on email sending functions to reduce the impact of automated abuse. Additionally, educate users and administrators about this vulnerability and encourage vigilance against phishing attempts that may leverage this flaw. Finally, isolate Keycloak instances in segmented network zones to limit potential lateral movement if exploitation occurs.

Description

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.

Impact

For European organizations, the primary impact of CVE-2025-8419 lies in the potential misuse of their Keycloak servers to send unsolicited emails, which can lead to reputational damage and possible blacklisting of their email domains. This could disrupt legitimate email communications and erode trust with customers and partners. Additionally, attackers might use this capability as a foothold for more sophisticated attacks, such as phishing campaigns or social engineering, leveraging the legitimacy of the originating server. While the direct confidentiality and availability impacts are low, the integrity of email communications and organizational reputation are at risk. Organizations in sectors with high regulatory scrutiny, such as finance, healthcare, and government, may face compliance challenges if exploited. The vulnerability's remote exploitability without authentication increases the risk profile, especially for publicly accessible Keycloak instances. Monitoring and early detection of anomalous email activity are critical to mitigating downstream effects.

Summary

CVE-2025-8419 is a vulnerability classified as CRLF injection found in the Red Hat build of Keycloak version 26.0. The flaw arises from improper neutralization of CRLF (Carriage Return Line Feed) sequences in the email registration process, allowing an attacker to inject special characters that manipulate SMTP commands. This injection causes the Keycloak server to send short, unsolicited emails, limited by the 64-character constraint on the local part of the email address. The emails generated are minimal, typically containing a subject and a small amount of data, which restricts the scope of direct damage. However, the ability to send emails from a legitimate server without authorization can be exploited for spam, phishing, or as a vector to test further vulnerabilities in the email infrastructure. The vulnerability does not require authentication or user interaction, making it remotely exploitable over the network. The CVSS 3.1 score of 6.5 reflects a medium severity, with low impact on confidentiality and integrity but no impact on availability. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability is a concern primarily for organizations relying on Keycloak for identity management, especially those using the Red Hat build in production environments.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 20 Nov 2025, 21:43 UTC

Technical details

References

Community reviews

Related threats