A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
CVE-2025-1391
MEDIUMNVD 5.45.4—
EchelonGraph scoreMEDIUM confidence
This medium-severity CVE scores 5.4 under NVD CVSS v3. EPSS exploit probability: 0.1%, top 74% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
Triggered by: NVD CVSS baseline
Sources: epss, nvd
5.4
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
- Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS: 0%CVSS: 5.4Exploit: NoneExposed: 0
A fix is available — apply it.
- CVSS v3
- 5.4
- EG Score
- 5.4(medium)
- EPSS
- 29.9%
- KEV
- Not listed
Published
February 17, 2025
Last Modified
May 6, 2026
Advisory Details (6)
Auto-updated May 6, 2026Patch available. Sources: redhat.
generic
Only set organization to client session when re-authenticating if user is member of the mapped organization by pedroigor · Pull Request #37235 · keycloak/keycloak · GitHub
https://github.com/keycloak/keycloak/pull/37235generic
Wrong organization claim assignment in JWT access token · Issue #37169 · keycloak/keycloak · GitHub
https://github.com/keycloak/keycloak/issues/37169redhat Patch Available
2346082 – (CVE-2025-1391) CVE-2025-1391 keycloak-services: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
https://bugzilla.redhat.com/show_bug.cgi?id=2346082redhat Patch Available
redhat Patch Available
Patch Availability(2)
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| redhat | keycloak-services | 2025-03-10 | redhat |
| redhat | rhbk/keycloak-rhel9-operator:26.0-12 | 2025-03-10 | redhat |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
Affected Packages
(1 across 1 ecosystem)
Maven(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| org.keycloak:keycloak-services | 1.0-alpha-1 ... 9.0.3 (190 versions) | 26.0.10 | — |
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
All Vendor Advisories
(2)
Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.
Frequently asked(5)
What is CVE-2025-1391?
CVE-2025-1391 is a medium vulnerability published on February 17, 2025. A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on…
When was CVE-2025-1391 disclosed?
CVE-2025-1391 was first published in the National Vulnerability Database on February 17, 2025, with the most recent update on May 6, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2025-1391 actively exploited?
CVE-2025-1391 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 29.9% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2025-1391?
CVE-2025-1391 has a CVSS v3 base score of 5.4 (NVD).
How do I remediate CVE-2025-1391?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2025-1391, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2025-1391
Is Your Infrastructure Affected by CVE-2025-1391?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.