CVE-2025-1391 Overview
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization's domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
Critical Impact
Applications relying on organization claims for authorization may incorrectly grant access to users who are not actual members of an organization, leading to unauthorized access and privilege escalation.
Affected Products
- Keycloak (versions with organization feature enabled)
- Red Hat Single Sign-On (RHSSO) - affected versions
- Red Hat Build of Keycloak
Discovery Timeline
- February 17, 2025 - CVE-2025-1391 published to NVD
- March 10, 2025 - Last updated in NVD database
Technical Details for CVE-2025-1391
Vulnerability Analysis
This vulnerability represents an Improper Access Control (CWE-284) issue in Keycloak's organization feature. The flaw exists within the token mapper functionality that handles organization membership claims. When a user registers or authenticates with a username or email address that matches an organization's configured domain pattern, the mapper incorrectly assigns organization membership to that user's token claims without properly validating actual organizational membership.
The vulnerability enables a scenario where authentication tokens contain false organizational claims. Since many applications use these token claims as the authoritative source for determining user permissions and access levels, this misrepresentation can lead to significant security breaches in multi-tenant environments.
Root Cause
The root cause stems from insufficient validation logic within the organization mapper component. The mapper appears to use domain pattern matching as a proxy for organizational membership rather than validating against the actual organization membership database. This design flaw allows any user whose email or username happens to match an organization's domain pattern to receive organization-related claims in their authentication token, regardless of their true membership status.
Attack Vector
This vulnerability is exploitable over the network by authenticated users with low privileges. An attacker can exploit this flaw by:
- Identifying target organizations and their domain patterns configured in Keycloak
- Registering or updating their account with a username or email that matches the target organization's domain pattern
- Authenticating to receive a token containing false organizational claims
- Using the manipulated token to access resources or functionality restricted to organization members
The attack requires no user interaction and can be performed by any authenticated user, making it particularly dangerous in environments where organization-based access control is critical for data segregation or feature gating.
Detection Methods for CVE-2025-1391
Indicators of Compromise
- Unusual access patterns from users to organization-restricted resources they shouldn't have access to
- Token claims showing organization membership for users not found in organization member lists
- User registrations or profile updates with email addresses or usernames matching multiple organization domain patterns
- Authorization logs showing access grants based on organization claims that don't match HR or directory records
Detection Strategies
- Implement logging at the authorization layer to capture organization claim validation events
- Create correlation rules to match organization claims in tokens against actual membership databases
- Monitor for users accessing resources across multiple organizations in short time windows
- Audit Keycloak organization domain pattern configurations for overly permissive patterns
Monitoring Recommendations
- Enable detailed authentication event logging in Keycloak to capture token generation details
- Set up alerts for authorization decisions based on organization claims
- Periodically reconcile token-based organization memberships with actual membership records
- Monitor for anomalous access patterns in multi-tenant or organization-segregated environments
How to Mitigate CVE-2025-1391
Immediate Actions Required
- Review and audit all organization domain patterns configured in Keycloak
- Implement additional authorization checks at the application level that validate organization membership through direct API calls
- Consider temporarily disabling the organization feature if it's not critical to operations
- Audit access logs for potential exploitation of this vulnerability
Patch Information
Red Hat has released security advisories addressing this vulnerability. Organizations should apply the following patches as soon as possible:
For additional details and CVE analysis, refer to the Red Hat CVE Analysis for CVE-2025-1391 and Red Hat Bug Report #2346082.
Workarounds
- Implement defense-in-depth by adding secondary organization membership validation at the application layer rather than solely relying on token claims
- Restrict organization domain patterns to be as specific as possible, avoiding wildcard or broad patterns
- Use explicit organization membership assignment workflows rather than domain-based auto-assignment
- Consider implementing additional claim validation middleware that cross-references organization claims against authoritative membership sources
# Configuration example - Review and audit organization domain patterns
# In Keycloak Admin Console, navigate to:
# Organizations > [Organization Name] > Domain Settings
# Ensure domain patterns are restrictive and specific
# Example: Verify organization membership via Keycloak Admin API
curl -X GET "https://keycloak.example.com/admin/realms/{realm}/organizations/{org-id}/members" \
-H "Authorization: Bearer ${ADMIN_TOKEN}" \
-H "Content-Type: application/json"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
