Read the docs
TI-2025-10015 Aliases CVE-2025-10939GHSA-vjr8-56p3-fmqq

Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console

Priority LOW 18CWE-427Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-427.

Summary

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00411 35th percentileScored 2026-11-07
Fix Fixed keycloak (Keycloak): 26.4.4org.keycloak:keycloak-quarkus-server (Maven): 26.4.4Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Keycloakkeycloakbefore 26.4.426.4.4Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4.4-1Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-3Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-3Patch availableCNA
Red HatRed Hat build of Keycloak 26.4.4——Not affectedCNA
—org.keycloak:keycloak-quarkus-server (Maven)before 26.4.426.4.4Patch availableGHSA-vjr8-56p3-fmqq
  • keycloak VendorKeycloak Affected before 26.4.4 Fixed in 26.4.4 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.4-1 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-3 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-3 Patch available CNA
  • Red Hat build of Keycloak 26.4.4 VendorRed Hat Affected — Fixed in — Not affected CNA
  • org.keycloak:keycloak-quarkus-server (Maven) Vendor— Affected before 26.4.4 Fixed in 26.4.4 Patch available GHSA-vjr8-56p3-fmqq

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:/a:redhat:build_keycloak:26.4::el926.4—Red Hat
  • cpe:/a:redhat:build_keycloak:26.4::el9 Versions 26.4 — ·Red Hat

Remediation

  • Fix · CNA keycloak (Keycloak) Fixed in 26.4.4
  • Fix · GHSA-vjr8-56p3-fmqq org.keycloak:keycloak-quarkus-server (Maven) Fixed in 26.4.4 Advisory →

Red Hat 2 advisories

  • RHSA-2025:21371 Released 2025-11-13 · Red Hat rating Moderate
    Red Hat build of Keycloak 26.4.4 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2025:21370 Released 2025-11-13 · Red Hat rating Moderate
    Red Hat build of Keycloak 26.4.4 Security Update
    • Red Hat build of Keycloak 26.4.4

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Keycloak 26.4Fixed RHSA-2025:21371
Red Hat build of Keycloak 26.4.4Fixed RHSA-2025:21370

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-10939
  2. 2026-10-03 Alias added: GHSA-vjr8-56p3-fmqq

References

Advisory 3

Other 6

  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
  • TI-2017-05120 It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens… CVSS 3.0CRITICAL 9.8
  • TI-2017-08952 Weak password recovery in Red Hat Keycloak CVSS 3.0HIGH 8.8
  • TI-2014-03024 The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak… CVSS 3.0HIGH 8.8
  • TI-2026-01295 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users CVSS 3.1HIGH 8.1
  • TI-2017-08950 Insufficient session expiration in Red Hat keycloak CVSS 3.0HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences