---
id: "CVE-2025-11537"
kind: "vulnerability"
aliases: ["CVE-2025-11537", "GHSA-gv3v-2cpp-3pmq"]
title: "Keycloak logs sensitive headers"
severity: "medium"
cvss: 5.0
epss: 0.00164
exploited: false
status: "open"
category: "package"
products: [{"name": "org.keycloak:keycloak-quarkus-server", "fixed": ["26.5.6"], "affected": "< 26.5.6", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-117", "java", "keycloak", "package", "self-hosted"]
not_affected_if: ["default-logging-format", "log-access-restricted"]
published_at: "2026-02-10T11:16:09+00:00"
first_seen_at: "2026-10-30T21:35:30+00:00"
updated_at: "2026-10-30T21:55:54+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gv3v-2cpp-3pmq", "first_seen_at": "2026-10-30T21:35:30+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11537", "first_seen_at": "2026-10-30T21:55:54+00:00"}]
---

# Keycloak logs sensitive headers

When Keycloak's logging format is set to a verbose user-supplied pattern such as 'long', it writes sensitive headers including Authorization and Cookie to the logs unmasked. An attacker who can read those log files can take bearer tokens or session cookies and impersonate users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.keycloak:keycloak-quarkus-server affected < 26.5.6 fixed 26.5.6

## How to check

- Check the Keycloak logging format setting for a verbose or user-supplied pattern such as 'long'.
- Check the Keycloak version with `maven` dependency `org.keycloak:keycloak-quarkus-server` and compare against `26.5.6`.
- Check who can read Keycloak log files on the host or in the log store.

## Fix

- `org.keycloak:keycloak-quarkus-server` to `26.5.6` or later in the 26.5 line.
- `26.4.11` for the 26.4 line; `26.6.0` for the 26.6 line.

## Timeline

- 2026-10-30T21:35:30+00:00 ghsa https://github.com/advisories/GHSA-gv3v-2cpp-3pmq
- 2026-10-30T21:55:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-11537

## Documents

- [fix] Patch: github.com https://github.com/keycloak/keycloak/commit/137a35c1109ff43a305f26264978a3ea21452373
- [fix] Patch: github.com https://github.com/keycloak/keycloak/commit/5a3cdb7c4ccbf83ffc926f70d655a60269d7207b
- [fix] Patch: github.com https://github.com/keycloak/keycloak/commit/9622f550a6e565b29a3a37454421f08626791a6c

## From the sources

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.

Patches are available, see:

- https://github.com/keycloak/keycloak/releases/tag/26.4.11
- https://github.com/keycloak/keycloak/releases/tag/26.5.6
- https://github.com/keycloak/keycloak/releases/tag/26.6.0

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_