Get real-time updates on Telegram
CVE-2025-10044: keycloak 0 to before 26.2.9; +4 more affected products
CVE-2025-10044. CVSS 3.1 base score 4.3 (MEDIUM, Vendor/CNA). EPSS 0.00309 (percentile 0.222), scored 17-Oct-2026.
Affected technology
keycloak · 0 to before 26.2.9
Keycloak
Red Hat build of Keycloak 26.0 · Exact affected versions not specified by the source
Red Hat
Red Hat build of Keycloak 26.0.17 · Exact affected versions not specified by the source
Red Hat
Red Hat build of Keycloak 26.2 · Exact affected versions not specified by the source
Red Hat
Red Hat build of Keycloak 26.2.9 · Exact affected versions not specified by the source
Red Hat
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required
What an attacker can do
An attacker can craft URLs with misleading messages (e.g., fake support phone numbers or URLs), which are displayed within the trusted Keycloak UI. Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality and availability impact as none; integrity impact as low.
- CWE
- CWE-79
- CCR priority
- 17.3 /100 (P5)
- CVSS 3.1
- 4.3 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · Vendor/CNA
- EPSS
- 0.00309 · percentile 0.222 · 2026-10-17
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-18 22:50:08.248207+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-10044.html