CVE-2025-7365

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-7365
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7365.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-7365
Aliases
Downstream
Published
2025-07-10T14:20:45.775Z
Modified
2026-07-16T03:48:07.635590762Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Keycloak: phishing attack via email verification step in first login flow
Details

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

Database specific 
{
    "cwe_ids": [
        "CWE-346"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7365.json",
    "cna_assigner": "redhat"
}
References

Affected packages

Git / github.com/keycloak/keycloak

Affected ranges

Type
GIT
Repo
https://github.com/keycloak/keycloak
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ba2566fe5fe30d868eceaaf209314d2ff4dcd4b6
Introduced
4cb4d2d06ed17e3a8bd928f472d3f9e4d1adea1d
Fixed
51bd67030d264a6f001de425ce558fad55970336
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.0.13"
        },
        {
            "introduced": "26.2.0"
        },
        {
            "fixed": "26.2.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0-alpha-1
1.0-alpha-1-12062013
1.0-alpha-2
1.0-alpha-3
1.0-beta-1
1.0-beta-2
1.0-beta-4
1.0-final
1.0-rc-1
1.0.0.Final
1.1.0.Beta2
1.3.0.Final
2.*
2.4.0.Test

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7365.json"