CVE-2025-13467 — Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objec…
Published: 2025-11-25 · CVSS: 5.5 · CVSS 3.1
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7