CVE-2025-5416: Keycloak-core: keycloak environment information
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information.
Other sources
An information disclosure vulnerability has been identified in Red Hat build of Keycloak . The /admin/serverinfo endpoint contains internal server details and returns a 401 Unauthorized error when an authenticated user attempts to access it directly.
However, the vulnerability occurs when an authenticated user logs into the system or accesses the admin console. The user's browser automatically sends a request to the /admin/serverinfo endpoint. includes sensitive server information. This response can be captured and viewed using browser developer tools or an HTTP proxy, thereby allowing any authenticated user to unintentionally access these internal server details.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5416?
CVE-2025-5416 is classified as a medium severity vulnerability due to its potential for unauthorized information disclosure.
How can I fix CVE-2025-5416?
To mitigate CVE-2025-5416, ensure that access to the /admin/serverinfo endpoint is restricted to authorized users only.
What information can be disclosed through CVE-2025-5416?
CVE-2025-5416 can inadvertently disclose sensitive environment information to authenticated users.
Who is affected by CVE-2025-5416?
CVE-2025-5416 affects installations of Red Hat Keycloak that allow access to the /admin/serverinfo endpoint.
Is user authentication required for CVE-2025-5416 to be exploited?
Yes, CVE-2025-5416 requires that the user is already authenticated to exploit the information disclosure vulnerability.