CVE-2025-11538
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-13

Last updated on: 2025-11-13

Assigner: Red Hat, Inc.

Description
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-13
Last Modified
2025-11-13
Generated
2026-06-16
AI Q&A
2025-11-13
EPSS Evaluated
2026-06-14
NVD
CVE-2025-11538
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
keycloak keycloak *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1327 The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Keycloak's server occurs when debug mode is enabled with the --debug option. It insecurely binds the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0), exposing the debug port to the local network. This allows an attacker on the same network segment to connect a remote debugger and potentially execute code remotely within the Keycloak Java virtual machine.

Impact Analysis

An attacker on the same local network can exploit this vulnerability to attach a remote debugger to the Keycloak server, leading to remote code execution within the Java virtual machine. This can compromise the security and integrity of the Keycloak server and potentially the systems relying on it.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart