CVE-2025-10939

🗓️ 28 Oct 2025 03:08:30Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 6 Views🌐 WEB

CVE-2025-10939: Keycloak admin console can be accessed via non-normalized paths through a proxy.

Reporter	Title	Published	Views	Family All 27
Chainguard	CVE-2025-10939 vulnerabilities	7 Jan 202601:30	–	cgr
Circl	CVE-2025-10939	28 Oct 202506:51	–	circl
CNNVD	Red Hat build of Keycloak 代码问题漏洞	28 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-10939 Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console	28 Oct 202503:08	–	cvelist
EUVD	EUVD-2025-36426	2 Dec 202501:21	–	euvd
Github Security Blog	Duplicate Advisory: Keycloak allows access to admin path through flaw	28 Oct 202506:31	–	github
Github Security Blog	Keycloak unable to restrict access to the admin console	2 Dec 202501:21	–	github
Tenable Nessus	Keycloak Admin Path Traversal Vulnerability (CVE-2025-10939)	31 Oct 202500:00	–	nessus
NVD	CVE-2025-10939	28 Oct 202504:16	–	nvd
OSV	CGA-5446-MXHQ-43FM	12 Jan 202601:08	–	osv

Vulners

Node

keycloak keycloakRange≤0

[
  {
    "vendor": "Keycloak",
    "product": "keycloak",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "26.4.4",
        "versionType": "semver"
      }
    ],
    "packageName": "keycloak",
    "collectionURL": "https://github.com/keycloak/keycloak",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.4",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhbk/keycloak-operator-bundle",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "26.4.4-1",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.4",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhbk/keycloak-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "26.4-3",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.4",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhbk/keycloak-rhel9-operator",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "26.4-3",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.4.4",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "org.keycloak/keycloak-quarkus-server",
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.4::el9"
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/errata/RHSA-2025:21370
access	www.access.redhat.com/errata/RHSA-2025:21371
github	www.github.com/keycloak/keycloak/pull/43765
access	www.access.redhat.com/security/cve/CVE-2025-10939
github	www.github.com/keycloak/keycloak/issues/43763

Parameter	Position	Path	Description	CWE
realms	path	/realms/{realm}/admin	Exposure of Keycloak admin UI via proxy misrouting allowing access through non-normalized/relative paths to the /admin application path under /realms.	CWE-427
admin	path	/realms/{realm}/admin	Exposure of Keycloak admin UI via proxy misrouting allowing access through non-normalized/relative paths to the /admin application path under /realms.	CWE-427

15 Apr 2026 00:35Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.13.7

EPSS0.00013

SSVC

CWE-427