{"id":"CVE-2025-10939","aliases":["EUVD-2025-36426","GHSA-c6cm-5gc7-c3f4","GHSA-vjr8-56p3-fmqq"],"status":"published","title":"Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console","description":"A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00411,"percentile":0.35771,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427"],"published":"2025-10-28T03:08:30Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-server","fixed_in":["26.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.4.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.4.4"}]}],"versions":["12.0.0","12.0.1","12.0.2","12.0.3","12.0.4","13.0.0","13.0.1","14.0.0","15.0.0","15.0.1","15.0.2","15.1.0","15.1.1","16.0.0","16.1.0","16.1.1","17.0.0","17.0.1","18.0.0","18.0.1","18.0.2","19.0.0","19.0.1","19.0.2","19.0.3","20.0.0","20.0.1","20.0.2","20.0.3","20.0.4","20.0.5","21.0.0","21.0.1","21.0.2","21.1.0","21.1.1","21.1.2","22.0.0","22.0.1","22.0.2","22.0.3","22.0.4","22.0.5","23.0.0","23.0.1","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","24.0.0","24.0.1","24.0.2","24.0.3","24.0.4","24.0.5","25.0.0","25.0.1","25.0.2","25.0.3","25.0.4","25.0.5","25.0.6","26.0.0","26.0.1","26.0.2","26.0.4","26.0.5","26.0.6","26.0.7","26.0.8","26.1.0","26.1.1","26.1.2","26.1.3","26.1.4","26.1.5","26.2.0","26.2.1","26.2.2","26.2.3","26.2.4","26.2.5","26.3.0","26.3.1","26.3.2","26.3.3","26.3.4","26.3.5","26.4.0","26.4.1","26.4.2","26.4.3"]}],"products":[{"vendor":"keycloak","product":"keycloak"},{"vendor":"red hat","product":"red hat build of keycloak 26.4"},{"vendor":"red hat","product":"red hat build of keycloak 26.4.4"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:21370","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:21371","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10939","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2398025","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/keycloak/keycloak/issues/43763","tags":["report","web"]},{"url":"https://github.com/keycloak/keycloak/pull/43765","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10939","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c6cm-5gc7-c3f4"},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-vjr8-56p3-fmqq","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vjr8-56p3-fmqq"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10939.json","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-10939","title":"Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console","description":"A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","status":"published","published":"2025-10-28T03:08:30.103Z","modified":"2026-08-31T00:28:27.541Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-36426","description":"A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","status":"published","published":"2025-10-28T03:08:30Z","modified":"2026-08-31T00:28:27Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:21.466916Z"}],"ghsa":[{"id":"GHSA-c6cm-5gc7-c3f4","title":"Duplicate Advisory:  Keycloak allows access to admin path through flaw","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references.\n\n### Original Description\nA flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","status":"withdrawn","published":"2025-10-28T06:31:05Z","modified":"2025-12-20T05:38:47Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:39:14.093341Z"},{"id":"GHSA-vjr8-56p3-fmqq","title":"Keycloak unable to restrict access to the admin console","description":"A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","status":"published","published":"2025-12-02T01:21:33Z","modified":"2025-12-02T01:21:35Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:39:11.110487Z"}],"nvd":[{"id":"CVE-2025-10939","description":"A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","status":"published","published":"2025-10-28T04:16:15.217Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:11:40.754193Z"}],"osv":[{"id":"CVE-2025-10939","title":"Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console","description":"A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","status":"published","published":"2025-10-28T03:08:30.103Z","modified":"2026-10-28T02:30:51.961309626Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"GHSA-c6cm-5gc7-c3f4","title":"Duplicate Advisory:  Keycloak allows access to admin path through flaw","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references.\n\n### Original Description\nA flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","status":"withdrawn","published":"2025-10-28T06:31:05Z","modified":"2025-12-20T05:38:46Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"GHSA-vjr8-56p3-fmqq","title":"Keycloak unable to restrict access to the admin console","description":"A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.","status":"published","published":"2025-12-02T01:21:33Z","modified":"2026-09-10T03:50:32.231009228Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}