Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-3910
CVE-2025-3910:
Java vulnerability analysis and mitigation
Overview
A vulnerability (CVE-2025-3910) was discovered in Keycloak's org.keycloak.authorization package. The flaw allows users to bypass required actions configured by administrators, specifically enabling users to circumvent security requirements such as two-factor authentication setup. The vulnerability was reported on April 23, 2025, and affects Red Hat build of Keycloak installations (Wiz Report, NVD).
Technical details
The vulnerability is classified with a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The flaw is categorized under CWE-287 (Improper Authentication) and specifically affects the Application-initiated actions (AIA) functionality in Keycloak. The vulnerability can be exploited through URL parameter manipulation during the sign-in process (Red Hat CVE, Red Hat Bugzilla).
Impact
When exploited, this vulnerability allows authenticated users to bypass administrator-configured required actions during the sign-in process. The primary security impact is the potential circumvention of critical security measures, particularly the ability to skip mandatory two-factor authentication setup requirements (Red Hat CVE).
Mitigation and workarounds
Red Hat has addressed this vulnerability by releasing security updates in Red Hat build of Keycloak 26.0.11. The fixes are available through two security advisories: RHSA-2025:4335 for the container images and RHSA-2025:4336 for the standalone packages. Users are advised to back up their existing installation, including all applications, configuration files, and databases before applying the updates (Red Hat Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management