CVE-2025-10939CWE-427

CVE-2025-10939

Low · published October 28, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.2th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-10-28T08:16Z
References (6)
https://access.redhat.com/errata/RHSA-2025:21370 · [email protected]https://access.redhat.com/errata/RHSA-2025:21371 · [email protected]https://access.redhat.com/security/cve/CVE-2025-10939 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2398025 · [email protected]https://github.com/keycloak/keycloak/issues/43763 · [email protected]https://github.com/keycloak/keycloak/pull/43765 · [email protected]
EPSS history
Timeline
  • 28 OCT 03:08Z
    Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console
    cvelistv5