GHSA-gv3v-2cpp-3pmq

Suggest an improvement
Source
https://github.com/advisories/GHSA-gv3v-2cpp-3pmq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gv3v-2cpp-3pmq/GHSA-gv3v-2cpp-3pmq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gv3v-2cpp-3pmq
Aliases
  • CVE-2025-11537
Published
2026-02-10T12:30:28Z
Modified
2026-02-11T19:26:17.778327Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Keycloak logs sensitive headers
Details

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.

Database specific 
{
    "github_reviewed_at": "2026-02-11T19:08:55Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-117"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2026-02-10T11:16:09Z"
}
References

Affected packages

Maven / org.keycloak:keycloak-quarkus-server

Package

Name
org.keycloak:keycloak-quarkus-server
View open source insights on deps.dev
Purl
pkg:maven/org.keycloak/keycloak-quarkus-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
26.6.0

Affected versions

12.*
12.0.0
12.0.1
12.0.2
12.0.3
12.0.4
13.*
13.0.0
13.0.1
14.*
14.0.0
15.*
15.0.0
15.0.1
15.0.2
15.1.0
15.1.1
16.*
16.0.0
16.1.0
16.1.1
17.*
17.0.0
17.0.1
18.*
18.0.0
18.0.1
18.0.2
19.*
19.0.0
19.0.1
19.0.2
19.0.3
20.*
20.0.0
20.0.1
20.0.2
20.0.3
20.0.4
20.0.5
21.*
21.0.0
21.0.1
21.0.2
21.1.0
21.1.1
21.1.2
22.*
22.0.0
22.0.1
22.0.2
22.0.3
22.0.4
22.0.5
23.*
23.0.0
23.0.1
23.0.2
23.0.3
23.0.4
23.0.5
23.0.6
23.0.7
24.*
24.0.0
24.0.1
24.0.2
24.0.3
24.0.4
24.0.5
25.*
25.0.0
25.0.1
25.0.2
25.0.3
25.0.4
25.0.5
25.0.6
26.*
26.0.0
26.0.1
26.0.2
26.0.4
26.0.5
26.0.6
26.0.7
26.0.8
26.1.0
26.1.1
26.1.2
26.1.3
26.1.4
26.1.5
26.2.0
26.2.1
26.2.2
26.2.3
26.2.4
26.2.5
26.3.0
26.3.1
26.3.2
26.3.3
26.3.4
26.3.5
26.4.0
26.4.1
26.4.2
26.4.3
26.4.4
26.4.5
26.4.6
26.4.7
26.5.0
26.5.1
26.5.2
26.5.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gv3v-2cpp-3pmq/GHSA-gv3v-2cpp-3pmq.json"