CVE-2025-10939: Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console
A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.
Other sources
The keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy (see https://www.keycloak.org/server/reverseproxy#exposedpathrecommendations ). The problem is that, at least ha-proxy, can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms (which should be exposed). For example:
curl --path-as-is http://localhost:7080/realms/../admin/master/console/#/master/info <http://localhost:7080/admin/master/console/#/master/info>
The admin path requires authentication but, in the end, the final customer is exposing a path that he thinks is not accessible. Also note that this is more an issue in ha-proxy than keycloak. Keycloak does not even document how to configure ha-proxy or any other proxy, it just recommends to not expose the /admin app. For example mod-proxy correctly manages non-normalized URLs, because it normalizes the path before to be sure it's inside the prefix-path.
Nevertheless we have reached the conclusion that keycloak should return an error by default for non-normalized URLs.
The installation should use a proxy configuration with ha-proxy with the common configuration.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-quarkus-serverto a version that resolves this vulnerability.Fixed in 26.4.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10939?
CVE-2025-10939 is classified as a medium severity vulnerability due to its potential to expose sensitive administrative paths.
How do I fix CVE-2025-10939?
To fix CVE-2025-10939, ensure to properly configure your proxy settings to prevent access to the /admin path from outside.
What are the impacted versions of Keycloak due to CVE-2025-10939?
CVE-2025-10939 affects all versions of Red Hat Keycloak that expose the /admin path without proper protections.
Can CVE-2025-10939 be exploited if using a reverse proxy?
Yes, CVE-2025-10939 can be exploited if the reverse proxy is misconfigured to allow access to relative or non-normalized paths.
What is the recommendation to prevent CVE-2025-10939?
The recommendation is to restrict external access to the /admin path and ensure proper proxy configurations to avoid unauthorized access.