What is the CVSS score of CVE-2025-7365?

CVE-2025-7365 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Keycloak. When are affected by CVE-2025-7365?

A critical authentication flaw in Keycloak allows attackers to hijack user accounts by impersonating victims during account merging operations, potentially compromising any organization relying on…. A patch is available.

How to fix or mitigate CVE-2025-7365?

Within 24 hours: Disable account linking/merging functionality in Keycloak configuration and notify all users of the temporary restriction. Within 7 days: Implement network-level controls to restrict Keycloak access and deploy email verification monitoring to detect suspicious verification attempts. Within 30 days: Evaluate alternative identity providers or prepare for emergency patching; conduct user awareness training on phishing risks and establish incident response procedures for account compromise reports.

Keycloak. When CVE-2025-7365

EUVD-2025-20994 HIGH

Origin Validation Error (CWE-346)

2025-07-10 secalert@redhat.com

GHSA-xhpr-465j-7p9q

Information Disclosure

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-20994

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

CVE Published

Jul 10, 2025 - 15:15 nvd

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

36 maven packages depend on org.keycloak:keycloak-services (16 direct, 20 indirect)

Ecosystem-wide dependent count for version 26.2.0.

DescriptionCVE.org

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

AnalysisAI

CVE-2025-7365 is an account takeover vulnerability in Keycloak affecting authenticated users during IdP-initiated account merging workflows. An attacker with valid authentication can manipulate the account merge process to change an email address to match a victim's email, triggering a verification email to the victim that lacks sender attribution-enabling phishing. Successful exploitation grants the attacker full account access to the victim's Keycloak account with high confidentiality, integrity, and availability impact (CVSS 7.1). No public POC or active KEV status has been confirmed at this time, but the attack requires low technical complexity and user interaction (clicking a verification link).

Technical ContextAI

The vulnerability exists in Keycloak's identity provider (IdP) account linking and profile review functionality. When an authenticated user initiates an account merge with an external IdP, Keycloak prompts for profile review before finalizing the link. The flaw resides in insufficient validation of email ownership during this review stage (CWE-346: Classification as Trusted Source). An attacker can modify the email field to an arbitrary victim's email address without proof-of-ownership checks prior to sending the verification email. The verification email is generic and does not include the attacker's email address or session identifier, making it appear as a legitimate account recovery/verification message to the victim. This violates the principle of email-as-identity-proof without prior authorization and exploits Keycloak's trust in the review-profile workflow. Affected Keycloak versions incorporate this flaw in the account management and federation modules, typically instantiated via OpenID Connect or SAML IdP connectors.

RemediationAI

Immediate actions: (1) Disable account linking features if not operationally required, or restrict to trusted IdPs only via Keycloak ACLs. (2) Review and enforce email verification policies—require email ownership validation (confirmation token sent to the email address being set) before finalizing any email change during account merge, separate from the initial account linking verification. (3) Audit logs: enable and monitor account linking and email modification events for suspicious patterns. (4) User education: warn users not to click verification links from unexpected emails or to verify sender identity. (5) Apply patches from Keycloak security advisories once available (check https://www.keycloak.org/security or your vendor's advisory database for CVE-2025-7365 patch release details). Long-term: implement CWE-346 mitigations—require proof-of-ownership for any email address modifications in sensitive workflows, implement rate limiting on verification email sends per account/IP, and use email headers (From/Reply-To) that clearly identify the Keycloak instance and requester.