8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3501

CVE-2025-3501: Keycloak hostname verification

A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate verification is skipped, which is unintended.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3501

CVE-2025-3501:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	< 26.2.2	26.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis focused on the provided commit 99ca24c832729075e04d8bc58666089268314272. The core of the vulnerability, as described, is that setting a hostname verification policy to 'ANY' skips trust store certificate verification. The commit diff for services/src/main/java/org/keycloak/truststore/JSSETruststoreConfigurator.java clearly shows the removal of a code block within the getTrustManagers method. This removed block was responsible for returning a permissive X509TrustManager (which performed no actual trust checks) when getProvider().getPolicy() == HostnameVerificationPolicy.ANY. This directly corresponds to the vulnerability description. Other changes in the commit were related to documentation updates warning against the use of 'ANY', updates to configuration option descriptions, and modifications to test files to cover this scenario and its fix. The test files themselves are not the vulnerable code but rather test the behavior of the production code. Therefore, the getTrustManagers method is identified as the vulnerable function because its previous implementation contained the logic that led to the security flaw.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.