Search: CVE-2025-11538

CVE-2025-11538 is a medium-severity vulnerability in Red Hat's build of Keycloak 26.4 where enabling debug mode causes the Java Debug Wire Protocol (JDWP) port to bind to all network interfaces (0.0.0.0) by default. This exposes the debug port to the local network, allowing attackers on the same network segment to attach a remote debugger and execute arbitrary code within the Keycloak JVM. The vulnerability requires no authentication or user interaction but has a high attack complexity due to network access requirements. Exploitation can lead to full compromise of the Keycloak server's confidentiality and integrity. No known exploits are currently reported in the wild. European organizations using this Keycloak version in network environments where debug mode might be enabled are at risk, especially those with sensitive identity and access management deployments.