CVE-2025-11537Medium· 5.0▾ SunlitKeycloak logs sensitive headers
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.2%
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.
Patches are available, see:
org.keycloak:keycloak-quarkus-server < 26.5.6Upgrade to a patched release:
org.keycloak:keycloak-quarkus-server 26.5.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9799Medium· 4.6Keycloak allows unauthorized access to resources via uma permission ticket bypass
GHSA-7pm9-g8jh-3m74Medium· 4.9Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
CVE-2026-9083Medium· 4.9Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
CVE-2026-9086High· 7.3Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
GHSA-37j9-56gh-j2r7High· 7.3Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
CVE-2026-9705Medium· 6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access token