A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may
    perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters
    (limited local part of the email), so the attack is limited to very shorts emails (subject and little
    data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent
    from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
    (CVE-2025-8419)

The version of Keycloak installed on the remote host is prior or equal to 26.3.2. It is, therefore, affected by SMTP inject vulnerability as reference in GHSA-qj5r-2r5p-phc7 advisory.

  - A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may     perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64     characters (limited local part of the email), so the attack is limited to very shorts emails (subject and     little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being     sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
    (CVE-2025-8419)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
458909	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.2.8	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458909	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.2.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
435357	SCA: security update for org.keycloak:keycloak-services (GHSA-m4j5-5x4r-2xp9)	Tenable Cloud Security	SCA Checks	Local	medium
435357	SCA: security update for org.keycloak:keycloak-services (GHSA-m4j5-5x4r-2xp9)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
246413	Keycloak <= 26.3.2 SMTP Inject (GHSA-qj5r-2r5p-phc7)	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-8419

medium

Tenable Plugins

medium

medium

medium

medium

medium