CVE-2025-13467: Keycloak LDAP Deserialization Vulnerability

CVE-2025-13467 Overview

CVE-2025-13467 is an insecure deserialization vulnerability [CWE-502] in the Keycloak LDAP User Federation provider. An authenticated realm administrator can configure the provider to point at a malicious LDAP server. That server can return crafted responses that trigger deserialization of untrusted Java objects inside the Keycloak process. The flaw is addressed in Keycloak 26.4.6, which adds default filtering of LDAP referrals to prevent unsafe URL references.

Critical Impact
A privileged realm administrator can leverage LDAP referral handling to trigger Java object deserialization against the Keycloak server, breaking the trust boundary between realm administration and the underlying identity broker process.

Affected Products

Red Hat build of Keycloak (see Red Hat Security Advisories RHSA-2025:22088, 22089, 22090, 22091)
Upstream Keycloak releases prior to 26.4.6
Deployments using the LDAP User Federation provider with referrals enabled

Discovery Timeline

2025-11-25 - CVE-2025-13467 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13467

Vulnerability Analysis

Keycloak integrates with directory services through its LDAP User Federation provider. A realm administrator can register an LDAP server and define search bases, bind credentials, and referral handling. When referral following is enabled, the JNDI/LDAP client inside Keycloak dereferences URLs returned by the remote directory. A hostile directory can return referral URLs that reference attacker-controlled endpoints and payload types.

Because the underlying Java LDAP client historically resolves referred objects through JNDI, a crafted response can drive the client into deserializing a Java object graph supplied by the attacker. Deserialization of untrusted data [CWE-502] against a class path containing exploitable gadget chains can result in arbitrary logic execution inside the Keycloak JVM.

Exploitation requires an authenticated realm administrator, which limits the population of attackers but does not eliminate risk. Federated identity brokers are frequently multi-tenant, and a compromised or malicious realm admin should not be able to influence the host process outside their realm.

Root Cause

The LDAP User Federation provider accepted arbitrary referral URLs and followed them through the JNDI LDAP context. There was no allow-list restricting referrals to the originally configured directory, and no restriction on the object types that could be materialized during referral resolution.

Attack Vector

The attacker configures a User Federation entry that binds to a directory under their control, enables referral following, and initiates any operation that triggers a search. The malicious directory returns a referral pointing at a URL whose response drives Java deserialization within Keycloak.

text

// Upstream fix - release note in docs/documentation/release_notes/topics/26_4_6.adoc
// [26.4] Only allow LDAP URL references when following referrals (#285)

This release adds filtering of LDAP referrals by default.
This change enhances security and aligns with best practices for LDAP configurations.

If you can not upgrade to this release yet, we recommend disabling LDAP referrals
in all LDAP providers in all of your realms.

Source: Keycloak GitHub Commit 754c070

Detection Methods for CVE-2025-13467

Indicators of Compromise

Keycloak User Federation entries whose connection URL points to hosts outside your approved directory infrastructure.
Outbound LDAP or LDAPS traffic from Keycloak servers to unexpected destinations, particularly ephemeral or cloud-hosted IPs.
Realm admin audit events creating or modifying ldap components with referral set to follow.
Unexpected JVM child processes or shell activity originating from the Keycloak service account.

Detection Strategies

Review Keycloak admin event logs for CREATE and UPDATE operations on COMPONENT resources of type org.keycloak.storage.UserStorageProvider with provider id ldap.
Alert on any LDAP referral URL that resolves outside the enterprise directory allow-list.
Inspect JVM behavior on Keycloak hosts for deserialization gadget indicators such as spawned processes, unexpected class loading, or crashes tied to LDAP queries.

Monitoring Recommendations

Forward Keycloak admin and system events to a central log platform and retain them for at least 90 days.
Baseline outbound network flows from Keycloak nodes and alert on new LDAP destinations.
Monitor for changes to the connectionUrl, bindDn, and referral attributes on LDAP federation components.

How to Mitigate CVE-2025-13467

Immediate Actions Required

Upgrade Keycloak to 26.4.6 or apply the Red Hat build patches from RHSA-2025:22088, RHSA-2025:22089, RHSA-2025:22090, and RHSA-2025:22091.
Audit all realm administrator accounts and remove privileges that are not required.
Review every LDAP User Federation provider and confirm the connectionUrl points only to trusted directories.

Patch Information

The upstream fix is tracked in Keycloak GitHub Issue #44478 and delivered by commit 754c070. Keycloak 26.4.6 restricts referral handling so that only LDAP URL references are followed. Red Hat customers should consult the Red Hat CVE page for CVE-2025-13467 and Bugzilla #2416038 for product-specific packages.

Workarounds

Disable LDAP referral following on every LDAP provider in every realm until the patch is deployed.
Restrict realm administrator role assignments and require multi-factor authentication for admin console access.
Apply egress network controls so that Keycloak nodes can only reach approved directory endpoints on ports 389 and 636.

bash

# Set referral handling to 'ignore' on an existing LDAP provider via kcadm
kcadm.sh update components/<COMPONENT_ID> -r <REALM> \
  -s 'config.referral=["ignore"]'

# Verify current configuration
kcadm.sh get components/<COMPONENT_ID> -r <REALM> \
  --fields providerId,name,config