Security Advisory

CVE-2025-11538

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-11-13 16:47:53

Last updated 2025-12-19 21:26:09

Assigner redhat

CVSS score not scored

State PUBLISHED

Description

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

← Browse all CVEs View on cve.org ↗