CVE-2025-11537 PUBLISHED

Keycloak-server: sensitive headers shown in the http access logs

Assigner: redhat
Reserved: 09.10.2025 Published: 10.02.2026 Updated: 10.02.2026

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS Score: 5

Product Status

Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

References

Problem Types

  • Improper Output Neutralization for Logs CWE