# CVE-2025-12390 in 26.4.2 (unpatched) **URL:** \ **Category:** Miscellanaeous\ **Created:** [November 5, 2025, 11:30pm UTC](https://forum.keycloak.org/t/cve-2025-12390-in-26-4-2-unpatched/31164 "2025-11-05T23:30:21Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jonnewell](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jonnewell](https://forum.keycloak.org/u/jonnewell)\ **Post date:** [November 5, 2025, 11:30pm UTC](https://forum.keycloak.org/t/cve-2025-12390-in-26-4-2-unpatched/31164/1 "2025-11-05T23:30:21Z")
This is being picked up by my github action for dependency review (actions/dependency-review-action@v4). Does anyone know if there is an expected patch? [https://github.com/advisories/GHSA-rg35-5v25-mqvp](https://github.com/advisories/GHSA-rg35-5v25-mqvp) Thanks -Jonathan ---
**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\ **Post date:** [November 6, 2025, 12:47pm UTC](https://forum.keycloak.org/t/cve-2025-12390-in-26-4-2-unpatched/31164/2 "2025-11-06T12:47:24Z")
Best to ask on the Keycloak repo where the maintainers are, as this is a community forum [GitHub - keycloak/keycloak: Open Source Identity and Access Management For Modern Applications and Services](https://github.com/keycloak/keycloak) FYI I checked, and I don’t see any specific discussions about that CVE. However, sometimes when something gets reported to security@, they don’t respond or post about it until the patch is done and the release has been cut. ---
**Author:** ![system](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/eb342909d95cf32cbb7517610022c6a0046a9ffb.png) [@system](https://forum.keycloak.org/u/system)\ **Post date:** [May 5, 2026, 12:47pm UTC](https://forum.keycloak.org/t/cve-2025-12390-in-26-4-2-unpatched/31164/3 "2026-05-05T12:47:47Z")
This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.