Moderate severityNVD Advisory· Published Aug 6, 2025· Updated Jan 8, 2026
Org.keycloak/keycloak-services: keycloak smtp inject vulnerability
CVE-2025-8419
Description
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | < 26.2.8 | 26.2.8 |
org.keycloak:keycloak-servicesMaven | >= 26.3.0, < 26.3.3 | 26.3.3 |
Affected products
7cpe:/a:redhat:build_keycloak:26.0+ 3 more
- cpe:/a:redhat:build_keycloak:26.0
- cpe:/a:redhat:build_keycloak:26.0::el9range: 26.0-19
- cpe:/a:redhat:build_keycloak:26.2
- cpe:/a:redhat:build_keycloak:26.2::el9range: 26.2-8
- osv-coords2 versions
< 26.2.5-r6+ 1 more
- (no CPE)range: < 26.2.5-r6
- (no CPE)range: < 26.2.8
Patches
Vulnerability mechanics
References
9- access.redhat.com/errata/RHSA-2025:15336ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2025:15337ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2025:15338ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2025:15339ghsavendor-advisoryx_refsource_REDHATWEB
- github.com/advisories/GHSA-m4j5-5x4r-2xp9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-8419ghsaADVISORY
- access.redhat.com/security/cve/CVE-2025-8419ghsavdb-entryx_refsource_REDHATWEB
- bugzilla.redhat.com/show_bug.cgighsaissue-trackingx_refsource_REDHATWEB
- github.com/keycloak/keycloak/security/advisories/GHSA-m4j5-5x4r-2xp9ghsaWEB
News mentions
0No linked articles in our index yet.