CVE-2025-10939
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A flaw was found in Keycloak. The Keycloak guides recommend not to expose the /admin path to the outside when using a proxy. The issue occurs at least via ha-proxy, as it can be tricked into using relative/non-normalized paths to access the /admin application path relative to /realms, which is expected to be exposed.
Risk Assessment
An attacker may gain access to the Keycloak admin panel, potentially leading to unauthorized configuration changes, account takeover, or other serious security breaches.
Recommendation
Configure the proxy to block external access to the /admin path. Update Keycloak to a patched version and follow security recommendations.
Original NVD description (English source)
A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.