CVE-2025-0604: Keycloak Auth Bypass Vulnerability

CVE-2025-0604 Overview

A flaw was found in Keycloak that allows authentication bypass when Active Directory users reset their passwords. When an AD user resets their password through Keycloak, the system updates the password without performing an LDAP bind to validate the new credentials against Active Directory. This vulnerability enables users whose AD accounts are expired or disabled to regain access in Keycloak, effectively bypassing AD restrictions and security controls.

Critical Impact

Users with expired or disabled Active Directory accounts can regain unauthorized access to Keycloak-protected resources by resetting their passwords, completely circumventing Active Directory account restrictions.

Affected Products

• Keycloak Identity and Access Management Platform
• Red Hat Single Sign-On (RHSSO)
• Red Hat Build of Keycloak

Discovery Timeline

• 2025-01-22 - CVE-2025-0604 published to NVD
• 2025-03-10 - Last updated in NVD database

Technical Details for CVE-2025-0604

Vulnerability Analysis

This vulnerability is classified as CWE-287 (Improper Authentication) and represents a critical flaw in how Keycloak handles password reset operations for users federated with Active Directory via LDAP.

Under normal circumstances, when a user authenticates against Keycloak with LDAP federation, Keycloak performs an LDAP bind operation to validate the credentials against the directory service. This bind operation not only verifies the password but also checks the account status—including whether the account is locked, disabled, or expired.

The flaw occurs specifically during the password reset workflow. When a user initiates a password reset through Keycloak's self-service password reset functionality, Keycloak updates the user's password in the local credential store and in Active Directory. However, it fails to perform a subsequent LDAP bind to validate that the account is still in good standing with AD.

Root Cause

The root cause lies in Keycloak's password reset implementation which bypasses the standard authentication flow that would normally enforce Active Directory account restrictions. The password update operation is executed without verifying the current account status in AD, creating a gap between Keycloak's local authentication state and the authoritative account status in Active Directory.

This design oversight means that:

• Disabled AD accounts can reset passwords and authenticate
• Expired AD accounts can regain access
• Accounts pending deletion can continue to function
• Any AD-level restrictions are not enforced during the reset flow

Attack Vector

An attacker with knowledge of an expired or disabled AD account's username and access to the associated email (for password reset verification) can exploit this vulnerability through the following attack chain:

1. Identify a target account that has been disabled or expired in Active Directory
2. Access Keycloak's self-service password reset functionality
3. Initiate a password reset request for the target account
4. Complete the password reset process using email verification or security questions
5. Authenticate to Keycloak with the newly set password
6. Gain access to all applications and resources protected by Keycloak

The vulnerability requires network access to the Keycloak instance and assumes the attacker can complete the password reset verification process. This typically requires access to the email account associated with the disabled AD account, or exploitation of weak password reset verification mechanisms.

Detection Methods for CVE-2025-0604

Indicators of Compromise

• Successful authentication events from accounts that are disabled or expired in Active Directory
• Password reset operations followed by authentication for accounts that should be restricted
• Discrepancies between Keycloak session logs and Active Directory account status
• Multiple password reset attempts for accounts in a disabled state
• Authentication from accounts that have not had valid AD logins for extended periods

Detection Strategies

• Implement correlation rules that cross-reference Keycloak authentication events with Active Directory account status
• Monitor password reset events and validate the AD account status at time of reset
• Create alerts for successful Keycloak authentications where corresponding AD accounts show disabled/expired status
• Deploy SIEM rules to detect authentication patterns from accounts that bypass normal AD restrictions

Monitoring Recommendations

• Enable detailed audit logging in Keycloak for all authentication and password reset events
• Configure Active Directory audit policies to track password changes initiated through LDAP
• Implement real-time synchronization checks between Keycloak and AD account states
• Review authentication logs regularly for accounts that should be restricted according to AD policies

How to Mitigate CVE-2025-0604

Immediate Actions Required

• Apply the latest security patches from Red Hat as documented in RHSA-2025:2544 and RHSA-2025:2545
• Audit current Keycloak sessions and terminate any sessions from accounts that should be disabled in AD
• Review recently reset passwords for federated AD accounts and verify account status
• Consider temporarily disabling self-service password reset for AD-federated users until patches are applied

Patch Information

Red Hat has released security advisories addressing this vulnerability. Organizations should apply the patches documented in RHSA-2025:2544 and RHSA-2025:2545. Additional details about the vulnerability can be found in Red Hat's CVE listing and Red Hat Bug Report #2338993.

Workarounds

• Disable self-service password reset functionality for LDAP-federated users until patches can be applied
• Implement a custom authentication flow that performs an additional LDAP bind after password reset operations
• Use Active Directory password writeback policies that require re-authentication against AD
• Configure periodic synchronization jobs to detect and disable Keycloak accounts whose AD counterparts are restricted
• Implement network-level access controls to limit exposure of the Keycloak password reset functionality

# Example: Disable self-service password reset in Keycloak realm settings
# Access Keycloak Admin Console and navigate to:
# Realm Settings -> Login -> User Registration -> Reset Password
# Set "Forgot Password" to OFF

# Alternatively, modify realm configuration via CLI:
/opt/keycloak/bin/kcadm.sh update realms/your-realm \
  -s "resetPasswordAllowed=false" \
  --server http://localhost:8080/auth \
  --realm master \
  --user admin