CVE-2025-10939
Low · 3.7CVSS
3.7
EPSS
0.4%
Published
Oct 28, 2025
CISA due date
—
The record
A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.keycloak:keycloak-quarkus-server | 0 | No fix |
| Maven | org.keycloak:keycloak-quarkus-server | 0 | 26.4.4 |
| Chainguard | keycloak-26.2-compat | 0 | 26.2.5-r6 |
| Chainguard | keycloak-26.3 | 0 | 26.3.5-r7 |
| Chainguard | keycloak-26.3-compat | 0 | 26.3.5-r3 |
| Chainguard | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r7 |
| Chainguard | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r6 |
| Chainguard | keycloak-26.4 | 0 | 26.4.4-r0 |
| Chainguard | keycloak-26.4-compat | 0 | 26.4.2-r2 |
| Chainguard | keycloak-26.4-iamguarded-compat | 0 | 26.4.5-r0 |
| Chainguard | keycloak-26.4-operator | 0 | 26.4.2-r2 |
| Chainguard | keycloak-26.4-operator-compat | 0 | 26.4.2-r2 |
| Chainguard | keycloak-fips-26.3 | 0 | 26.3.5-r7 |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | 0 | 26.3.5-r7 |
| Chainguard | keycloak-fips-26.3-operator | 0 | 26.3.5-r4 |
| Chainguard | keycloak-fips-26.3-operator-compat | 0 | 26.3.5-r4 |
| Chainguard | keycloak-fips-26.4 | 0 | 26.4.4-r0 |
| Chainguard | keycloak-fips-26.4-iamguarded-fips | 0 | 26.4.4-r0 |
| Chainguard | keycloak-fips-26.4-operator | 0 | 26.4.4-r0 |
| Chainguard | keycloak-fips-26.4-operator-compat | 0 | 26.4.4-r1 |
| Wolfi | keycloak-26.3 | 0 | 26.3.5-r7 |
| Wolfi | keycloak-26.3-compat | 0 | 26.3.5-r3 |
| Wolfi | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r7 |
| Wolfi | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r6 |
| Wolfi | keycloak-26.4 | 0 | 26.4.4-r0 |
| Wolfi | keycloak-26.4-compat | 0 | 26.4.2-r2 |
| Wolfi | keycloak-26.4-iamguarded-compat | 0 | 26.4.5-r0 |
| Wolfi | keycloak-26.4-operator | 0 | 26.4.2-r2 |
| Wolfi | keycloak-26.4-operator-compat | 0 | 26.4.2-r2 |
Related vulnerabilities
- GHSA-gv3v-2cpp-3pmq Keycloak logs sensitive headers Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-11537 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
- GHSA-v897-pv23-r8cw Keycloak has an improper input validation vulnerability Also affects org.keycloak:keycloak-quarkus-server
- CVE-2026-0976 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-11538 A vulnerability exists in Keycloak's server distribution where enabling debug mode… Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects keycloak-26.2-compat
- CVE-2025-14082 A flaw was found in Keycloak Admin REST (Representational State Transfer) API. Also affects keycloak-26.2-compat
- CVE-2025-13467 A flaw was found in the Keycloak LDAP User Federation provider. Also affects keycloak-26.2-compat