AIKIDO-2025-10335

TL;DR

Affected versions of this package are vulnerable to Credential Harvesting via Misconfigured Host/Port Settings, where an attacker with manage-realm permissions can exploit the email server configuration by modifying the host/port to point to a malicious server without needing to re-enter the existing credentials. The attacker can then harvest the stored credentials either by using the test connection feature or by triggering an email-sending workflow (e.g., password reset), causing Keycloak to authenticate with the attacker-controlled server and exposing the credentials.