CVE-2025-0604 - Reset passwords for Active Directory users

Products

• Service Virtualization

Issue/Introduction

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain condition

Environment

All Supported releases of DevTest

Resolution

This Keycloak defect is "Not Applicable" to Service Virtualization. While it does impact the LDAP area that is used in Service Virtualization, it is only applicable for resetting passwords of LDAP users in Keycloak, which is not allowed/supported in the Service Virtualization deployment of IAM.

Additional Information

CVE-2025-0604