What is GHSA-hw58-3793-42gg?

GHSA-hw58-3793-42gg is a security advisory published by GitHub Security Advisories with High severity. Keycloak hostname verification

Which CVE IDs does GHSA-hw58-3793-42gg cover?

GHSA-hw58-3793-42gg covers the following CVE IDs: CVE-2025-3501. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hw58-3793-42gg?

GHSA-hw58-3793-42gg has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-hw58-3793-42gg?

GHSA-hw58-3793-42gg affects 1 product, including: maven/org.keycloak:keycloak-services:\u003c 26.2.2.

GHSA-hw58-3793-42ggHighCVSS 8.2

Keycloak hostname verification

Vendor

GitHub Security Advisories

Published

April 30, 2025

Last Modified

August 7, 2025

🔗 CVE IDs covered (1)

CVE-2025-3501 →

📋 Description

A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate verification is skipped, which is unintended.

🎯 Affected products1

maven/org.keycloak:keycloak-services:< 26.2.2

🔗 References (10)

https://github.com/keycloak/keycloak/security/advisories/GHSA-hw58-3793-42gg
https://nvd.nist.gov/vuln/detail/CVE-2025-3501
https://access.redhat.com/errata/RHSA-2025:4335
https://access.redhat.com/errata/RHSA-2025:4336
https://access.redhat.com/security/cve/CVE-2025-3501
https://bugzilla.redhat.com/show_bug.cgi?id=2358834
https://github.com/keycloak/keycloak/commit/99ca24c832729075e04d8bc58666089268314272
https://github.com/keycloak/keycloak/issues/39350
https://github.com/keycloak/keycloak/pull/39366
https://github.com/advisories/GHSA-hw58-3793-42gg