CVE-2025-3501

HIGH

Published Apr 29, 2025 Modified Apr 15, 2026 CWE-297

Description

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.

Is your site exposed to CVE-2025-3501?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness Type (CWE)

CWE-297 CWE-297

References

Other References

https://access.redhat.com/errata/RHSA-2025:4335 https://access.redhat.com/errata/RHSA-2025:4336 https://access.redhat.com/errata/RHSA-2025:8672 https://access.redhat.com/errata/RHSA-2025:8690 https://access.redhat.com/security/cve/CVE-2025-3501 https://bugzilla.redhat.com/show_bug.cgi?id=2358834 https://github.com/keycloak/keycloak/issues/39350 https://github.com/keycloak/keycloak/pull/39366

Frequently Asked Questions

What is CVE-2025-3501? +

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended. It has a CVSS v3.1 base score of 8.2 (HIGH).

How severe is CVE-2025-3501? +

CVE-2025-3501 has a CVSS v3.1 score of 8.2 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2025-3501? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-2462

Allow attackers to intercept or falsify data exchanges between the client and the server

CVE-2026-115758

SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() in src/base/Http_win.cpp unconditionally passes INTERNET_FLAG_IGNORE_CERT_CN_INVALID to WinINet, …

CVE-2026-63374

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior …

CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured …

CVE-2026-66392

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not …

CVE-2026-19553

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check …