{"action":"Upgrade org.keycloak:keycloak-services to 26.0.13 (26.0.x) or 26.2.6 (26.2.x) or later.","affected":[{"fixed":"26.0.13","introduced":"0"},{"fixed":"26.2.6","introduced":"26.2.0"}],"component":"org.keycloak:keycloak-services","cve_ids":["CVE-2025-7365"],"ecosystem":"Maven","epss":0.00274,"exploited":false,"fixed_versions":["26.0.13","26.2.6"],"ghsa_id":"GHSA-xhpr-465j-7p9q","id":"tcs_01M5N9JDRM0FC4AT7THSTWH1R1","modified_at":"2025-07-30T14:42:20.089609Z","published_at":"2025-07-30T13:16:47Z","references":["https://osv.dev/vulnerability/GHSA-xhpr-465j-7p9q","https://github.com/keycloak/keycloak/security/advisories/GHSA-xhpr-465j-7p9q","https://nvd.nist.gov/vuln/detail/CVE-2025-7365","https://github.com/keycloak/keycloak/issues/40446","https://github.com/keycloak/keycloak/pull/40520","https://access.redhat.com/errata/RHSA-2025:11986","https://access.redhat.com/errata/RHSA-2025:11987","https://access.redhat.com/errata/RHSA-2025:12015","https://access.redhat.com/errata/RHSA-2025:12016","https://access.redhat.com/security/cve/CVE-2025-7365","https://bugzilla.redhat.com/show_bug.cgi?id=2378852","https://github.com/keycloak/keycloak","https://github.com/keycloak/keycloak/releases/tag/26.0.13","https://github.com/keycloak/keycloak/releases/tag/26.2.6","https://github.com/keycloak/keycloak/releases/tag/26.3.0"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-xhpr-465j-7p9q","url":"https://osv.dev/vulnerability/GHSA-xhpr-465j-7p9q"}],"summary":"Keycloak phishing attack via email verification step in first login flow"}