Vulnerability in Keycloak
CVE-2025-10939
A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (32.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 32.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Keycloak — versions 0
- Red Hat Build Of Keycloak 26.4 — versions 26.4.4-1, 26.4-3
- Red Hat Build Of Keycloak 26.4.4
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2025:21370 (vendor-advisory)
- access.redhat.com/errata/RHSA-2025:21371 (vendor-advisory)
- access.redhat.com/security/cve/CVE-2025-10939 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- github.com/keycloak/keycloak/issues/43763
- github.com/keycloak/keycloak/pull/43765
Frequently asked questions
- What is CVE-2025-10939?
- CVE-2025-10939 is a low-severity vulnerability in Keycloak, classified under Uncontrolled Search Path Element. CVSS score: 3.7/10. Published 2025-10-28.
- How severe is CVE-2025-10939?
- Low severity. CVSS v3 base score is 3.7 out of 10.