CVE-2025-8419: Keycloak-services SMTP Injection Vulnerability
Summary
CVE-2025-8419: Keycloak-services SMTP Inject Vulnerability. Affects org.keycloak:keycloak-services versions < 26.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keycloak-services is a component of the Keycloak identity and access management solution, which provides authentication and authorization services for applications. It allows users to manage their identities and access permissions securely. However, it has been found to be vulnerable to SMTP injection attacks, which can lead to the unintended sending of emails.
Vulnerability Detail
A vulnerability was discovered in Keycloak-services where special characters used during email registration can lead to SMTP injection. This flaw allows an attacker to send unsolicited emails from the Keycloak server, although the emails are limited to 64 characters in length. The primary risk is the potential for this flaw to be exploited as a precursor to more sophisticated attacks, despite the immediate consequence being the sending of short, unwanted emails.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user input during email registration to prevent special characters that could lead to SMTP injection. Implement input validation to restrict characters that can be used in email addresses.
Conclusion
The Keycloak-services SMTP injection vulnerability (CVE-2025-8419) poses a risk of unsolicited email being sent from the server. It is crucial to update to a patched version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
SMTP injection is a type of attack where an attacker manipulates the email sending process to send unauthorized emails.
The immediate consequence is the sending of unsolicited emails, which could lead to further attacks if exploited.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Yes, updating to a version beyond 26.3.2 will resolve this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
