{"id":"CVE-2025-11537","kind":"vulnerability","aliases":["CVE-2025-11537","GHSA-gv3v-2cpp-3pmq"],"related":[],"title":"Keycloak logs sensitive headers","description":"A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.\n\nPatches are available, see:\n\n- https://github.com/keycloak/keycloak/releases/tag/26.4.11\n- https://github.com/keycloak/keycloak/releases/tag/26.5.6\n- https://github.com/keycloak/keycloak/releases/tag/26.6.0","summary":"When Keycloak's logging format is set to a verbose user-supplied pattern such as 'long', it writes sensitive headers including Authorization and Cookie to the logs unmasked. An attacker who can read those log files can take bearer tokens or session cookies and impersonate users.","severity":"medium","cvss":5.0,"epss":0.00164,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-quarkus-server","fixed":["26.5.6"],"affected":"< 26.5.6","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-117","java","keycloak","package","self-hosted"],"not_affected_if":["default-logging-format","log-access-restricted"],"how_to_check":"- Check the Keycloak logging format setting for a verbose or user-supplied pattern such as 'long'.\n- Check the Keycloak version with `maven` dependency `org.keycloak:keycloak-quarkus-server` and compare against `26.5.6`.\n- Check who can read Keycloak log files on the host or in the log store.","fix":"- `org.keycloak:keycloak-quarkus-server` to `26.5.6` or later in the 26.5 line.\n- `26.4.11` for the 26.4 line; `26.6.0` for the 26.6 line.","status":"open","published_at":"2026-02-10T11:16:09+00:00","first_seen_at":"2026-10-30T21:35:30+00:00","triaged_at":"2026-10-30T21:36:51+00:00","updated_at":"2026-10-30T21:55:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T21:36:51Z","model":"claude-haiku-5-5","output":{"fix":"- `org.keycloak:keycloak-quarkus-server` to `26.5.6` or later in the 26.5 line.\n- `26.4.11` for the 26.4 line; `26.6.0` for the 26.6 line.","reach":"local","title":"Keycloak: verbose log format writes Authorization and Cookie headers in cleartext","impact":"high","summary":"When Keycloak's logging format is set to a verbose user-supplied pattern such as 'long', it writes sensitive headers including Authorization and Cookie to the logs unmasked. An attacker who can read those log files can take bearer tokens or session cookies and impersonate users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","java"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Session cookies and bearer tokens readable from logs, enabling account takeover.","analyst_note":"","how_to_check":"- Check the Keycloak logging format setting for a verbose or user-supplied pattern such as 'long'.\n- Check the Keycloak version with `maven` dependency `org.keycloak:keycloak-quarkus-server` and compare against `26.5.6`.\n- Check who can read Keycloak log files on the host or in the log store.","plain_action":"","needs_analyst":false,"not_affected_if":["default-logging-format","log-access-restricted"],"who_is_affected":"Deployments of the Keycloak Quarkus server that use a verbose or user-supplied logging pattern such as 'long' are exposed, because that pattern records request headers. Anyone with read access to those logs can reuse the captured tokens or cookies. Deployments on the default logging format, or where log access is tightly restricted, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4344,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11537':7A,15A '-117':22B '-2025':6A,14A '/keycloak/keycloak/releases/tag/26.4.11':152C '/keycloak/keycloak/releases/tag/26.5.6':155C '/keycloak/keycloak/releases/tag/26.6.0':158C '2cpp':11A '3pmq':12A 'access':120C 'account':144C 'attack':59B,117C 'author':51B,106C 'avail':148C 'bearer':68B,130C 'cleartext':115C 'compromis':145C 'configur':87C 'cooki':53B,72B,108C,133C 'credenti':128C 'cve':5A,13A 'cwe':21B 'defin':100C 'disclos':110C 'e.g':129C 'extract':126C 'file':65B,124C 'flaw':77C 'format':33B,85C 'found':79C 'full':143C 'ghsa':9A 'ghsa-gv3v-2cpp-3pmq':8A 'github.com':151C,154C,157C 'github.com/keycloak/keycloak/releases/tag/26.4.11':150C 'github.com/keycloak/keycloak/releases/tag/26.5.6':153C 'github.com/keycloak/keycloak/releases/tag/26.6.0':156C 'gv3v':10A 'header':4A,49B,104C 'host':28B 'imperson':74B,138C 'includ':50B,105C 'java':23B 'keycloak':1A,18A,24B,30B,81C 'keycloak-quarkus-server':17A 'lead':140C 'log':2A,32B,56B,64B,84C,113C,123C 'long':45B,101C 'org.keycloak':16A 'packag':25B 'patch':146C 'pattern':42B,94C,102C 'pre':99C 'pre-defin':98C 'quarkus':19A 'read':62B,119C 'see':149C 'self':27B 'self-host':26B 'sensit':3A,48B,103C 'server':20A 'session':71B,132C 'set':35B 'suppli':41B,93C 'take':67B 'token':69B,131C 'unmask':57B 'use':135C 'user':40B,75B,92C,139C 'user-suppli':39B,91C 'verbos':38B,90C 'write':47B","nicknames":[],"mitigations":[],"who_affected":"Deployments of the Keycloak Quarkus server that use a verbose or user-supplied logging pattern such as 'long' are exposed, because that pattern records request headers. Anyone with read access to those logs can reuse the captured tokens or cookies. Deployments on the default logging format, or where log access is tightly restricted, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-02-10T11:16:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gv3v-2cpp-3pmq","url":"https://github.com/advisories/GHSA-gv3v-2cpp-3pmq","severity":"medium","published_at":"2026-02-10T12:30:28+00:00","modified_at":"2026-10-30T21:31:49+00:00","first_seen_at":"2026-10-30T21:35:30+00:00","fetched_at":"2026-10-30T22:51:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-11537","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11537","severity":null,"published_at":"2026-02-10T11:16:09+00:00","modified_at":"2026-10-30T19:17:39+00:00","first_seen_at":"2026-10-30T21:55:54+00:00","fetched_at":"2026-10-30T21:55:54+00:00","note":null}],"documents":[{"id":26097,"url":"https://github.com/keycloak/keycloak/commit/137a35c1109ff43a305f26264978a3ea21452373","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":26098,"url":"https://github.com/keycloak/keycloak/commit/5a3cdb7c4ccbf83ffc926f70d655a60269d7207b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":26099,"url":"https://github.com/keycloak/keycloak/commit/9622f550a6e565b29a3a37454421f08626791a6c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}