CVE-2025-10939: 
Java vulnerability analysis and mitigation

CVE-2025-10939 is a path traversal/access control bypass vulnerability in Keycloak (org.keycloak:keycloak-quarkus-server) that allows unauthenticated remote attackers to access the /admin console path through proxy configurations using relative or non-normalized URLs. Keycloak's deployment guides explicitly recommend blocking external access to the /admin path when using a reverse proxy, but HAProxy can be tricked into forwarding requests using traversal paths such as /realms/../admin/. The vulnerability affects versions of keycloak-quarkus-server prior to 26.4.4, and was publicly disclosed on October 28, 2025. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-427 (Uncontrolled Search Path Element): Keycloak does not reject or normalize non-normalized URL paths before routing, allowing path traversal sequences (e.g., /../) to bypass proxy-level access restrictions. When HAProxy is configured to block the /admin path but expose /realms, an attacker can craft a request such as curl --path-as-is http://host/realms/../admin/master/console/ to reach the admin interface, because HAProxy forwards the non-normalized path without stripping the traversal component. The fix requires Keycloak itself to return an error for non-normalized URLs by default, rather than relying solely on proxy configuration. Other proxies such as Apache mod_proxy are not affected because they normalize paths before forwarding (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation results in unauthorized access to the Keycloak admin console interface, which is intended to be restricted to internal networks. The confidentiality impact is rated Low — the admin path requires authentication, so an attacker reaching the interface does not automatically gain administrative control, but they are exposed to a surface that should not be externally reachable. There is no integrity or availability impact. The primary risk is information disclosure and potential further exploitation if admin credentials are weak or if additional vulnerabilities exist in the admin interface (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Attack complexity is rated High, as exploitation requires a specific proxy configuration (HAProxy) and the ability to send non-normalized path requests.

1. Reconnaissance: Identify Keycloak instances deployed behind HAProxy where the /admin path is intended to be blocked but /realms is exposed, using tools like Shodan or Censys searching for Keycloak login pages.
2. Craft traversal request: Construct an HTTP request using a relative/non-normalized path to traverse from the exposed /realms path to the restricted /admin path, e.g., curl --path-as-is http://target/realms/../admin/master/console/.
3. Bypass proxy restriction: Because HAProxy forwards the non-normalized path without stripping the traversal component, the request reaches the Keycloak backend as a request to /admin/master/console/.
4. Access admin interface: The Keycloak admin console login page is rendered, exposing an interface that the operator believed was inaccessible externally. Authentication is still required to proceed further (Red Hat Bugzilla).

• Network: HTTP requests containing non-normalized paths such as /realms/../admin/ or /realms/%2F..%2Fadmin/ in proxy or web server access logs; use of --path-as-is equivalent behavior in HTTP clients targeting Keycloak endpoints.
• Logs: Keycloak access logs showing requests to /admin/ originating from external IP addresses that should not have access; HAProxy logs showing forwarded requests with .. path components to the Keycloak backend.
• Process/Application: Unexpected access attempts to the Keycloak admin console from external or untrusted network segments, particularly with unauthenticated or failed login attempts logged in Keycloak's event log.

Red Hat released a patched version of Red Hat build of Keycloak 26.4.4 (RHSA-2025:21370 and RHSA-2025:21371), which addresses this vulnerability by having Keycloak return an error by default for non-normalized URLs (Red Hat Errata). The upstream fix is available in org.keycloak:keycloak-quarkus-server version 26.4.4 (GitHub Advisory). As a workaround prior to patching, administrators should ensure their proxy (especially HAProxy) is configured to normalize paths before forwarding, explicitly deny requests containing .. path traversal sequences, and apply network segmentation to restrict admin interface access to trusted internal networks only (Red Hat Bugzilla).

Red Hat triaged this issue with a Low/Moderate severity rating and included the fix in the Red Hat build of Keycloak 26.4.4 security advisory alongside four other CVEs (Red Hat Errata). The Red Hat Bugzilla entry notes that the issue is considered "more an issue in ha-proxy than keycloak," but the team concluded Keycloak should defensively reject non-normalized URLs by default (Red Hat Bugzilla). No significant broader community or social media discussion has been identified for this vulnerability.