Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-3910

19
FAUCET Score

CVE-2025-3910 describes a medium-severity flaw in the org.keycloak.authorization package of Red Hat build of Keycloak, allowing attackers to bypass required actions like two-factor authentication. This vulnerability has a CVSS score of 5.4, indicating a network-based attack requiring user interaction, with low impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 26.0, < 26.0.11CPE matchmatch criteria
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:text-only:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.4MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
2.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.39%
Probability of exploitation in next 30 days
EPSS Percentile
31.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0039 is in the 33rd percentile among its peer group of 26,236 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

mavenpatch availablevia ghsa
Product: org.keycloak:keycloak-servicesFixed in: 26.2.2
redhatpatch availablevia redhat_api
Product: Red Hat Build of KeycloakFixed in: org.keycloak.authentication
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Keycloak 26.0Fixed in: rhbk/keycloak-operator-bundle:26.0.11-2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Keycloak 26.0Fixed in: rhbk/keycloak-rhel9:26.0-12
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Keycloak 26.0Fixed in: rhbk/keycloak-rhel9-operator:26.0-13
View patch
redhatvendor investigatingvia nvd_reference
View patch

Vendor Advisories (2)

mavenGHSA-5jfq-x6xp-7rw2medium

Keycloak vulnerable to two factor authentication bypass

Apr 30, 2025
redhatCVE-2025-3910Moderate

org.keycloak.authentication: Two factor authentication bypass

Apr 29, 2025

References

access.redhat.com / errata/RHSA-2025:4335
Vendor Advisory
access.redhat.com / errata/RHSA-2025:4336
Vendor Advisory
access.redhat.com / security/cve/CVE-2025-3910
Vendor Advisory
bugzilla.redhat.com / show_bug.cgi
Vendor Advisory
github.com / keycloak/keycloak/issues/39349
Issue Tracking