Live › vulnerability › CVE-2025-11537
When Keycloak's logging format is set to a verbose user-supplied pattern such as 'long', it writes sensitive headers including Authorization and Cookie to the logs unmasked. An attacker who can read those log files can take bearer tokens or session cookies and impersonate users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:35 UTC, 0h before NVD. All times on this page are UTC.
Deployments of the Keycloak Quarkus server that use a verbose or user-supplied logging pattern such as 'long' are exposed, because that pattern records request headers. Anyone with read access to those logs can reuse the captured tokens or cookies. Deployments on the default logging format, or where log access is tightly restricted, are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-quarkus-server | maven | < 26.5.6 | 26.5.6 |
maven dependency org.keycloak:keycloak-quarkus-server and compare against 26.5.6.org.keycloak:keycloak-quarkus-server to 26.5.6 or later in the 26.5 line.26.4.11 for the 26.4 line; 26.6.0 for the 26.6 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.
Patches are available, see:
This page as .md · .json · in your agent: get_signal("CVE-2025-11537")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.