CVE-2025-10044: Keycloak Account and Admin UI Error Description Injection Vulnerability
Summary
CVE-2025-10044: Keycloak error_description injection on error pages that can trigger phishing attacks. Affects org.keycloak:keycloak-account-ui across 2 version ranges.
< 26.2.9
>= 26.3.0, < 26.3.4
Fixed in 26.2.9 or 26.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows users to secure applications and services with little to no code. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. The affected packages, 'keycloak-account-ui' and 'keycloak-admin-ui', are components of Keycloak that handle user account management and administrative tasks, respectively. This vulnerability arises from the improper handling of the 'error_description' query parameter, which can lead to security risks.
Vulnerability Detail
The vulnerability allows arbitrary text to be injected into the 'error_description' query parameter, which is then rendered on error pages without proper validation or sanitization. This can mislead users by displaying deceptive messages, such as fake support contact information, within the trusted Keycloak UI. Consequently, attackers can exploit this to create phishing attacks, tricking users into contacting malicious entities. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), and it has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 26.2.926.2.9 -
>= 26.3.0, < 26.3.426.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the server-side to mitigate the risk of misleading messages being displayed. However, this is not a permanent solution and updating to the patched versions is strongly recommended.
Conclusion
In summary, CVE-2025-10044 is a moderate severity vulnerability in Keycloak's account and admin UI that allows for error description injection, posing a risk of phishing attacks. It is crucial to update to the patched versions to mitigate this risk effectively.
See every vulnerability recorded for org.keycloak:keycloak-account-ui →
FAQ
CVE-2025-10044 is a vulnerability in Keycloak's account and admin UI that allows for error description injection, potentially leading to phishing attacks.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities based on your pom.xml file. Visit Vulert Scanner to use the Vulert playground.
The vulnerability can mislead users into contacting malicious actors by displaying deceptive messages in the Keycloak UI, leading to potential phishing attacks.
You can update your Keycloak packages by modifying your pom.xml file to include the patched versions of 'keycloak-account-ui' and 'keycloak-admin-ui'.
Yes, the permanent fix is to update to the patched versions of the affected packages as specified in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-account-ui.
