Is CVE-2025-10939 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10939 being exploited in the wild.

How severe is CVE-2025-10939?

Low severity, with a CVSS score of 3.7, published 28 October 2025.

Which products and versions are affected?

Keycloak ; org.keycloak:keycloak-quarkus-server (Maven) ECOSYSTEM:introduced=0,fixed=26.4.4.

Is there a fix for CVE-2025-10939?

Yes. org.keycloak:keycloak-quarkus-server (Maven): upgrade to 26.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-10939 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-10939?

Check whether you run Keycloak or org.keycloak:keycloak-quarkus-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10939: Keycloak path traversal in admin access via proxy

CVE-2025-10939 · Severity: low · CVSS 3.7 · Published 2025-10-28

Keycloak is an open-source identity and access management platform used to secure applications and control user authentication. When deployed behind a proxy (such as HA-Proxy), an attacker can exploit path normalization issues to bypass security controls and access the administrative interface that should not be exposed to the internet, potentially leading to unauthorized administrative access and account compromise.

Technologies: Keycloak, org.keycloak:keycloak-quarkus-server (Maven). Vendors: Keycloak, Maven.

Quick answers

Is CVE-2025-10939 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10939 being exploited in the wild.
How severe is CVE-2025-10939?: Low severity, with a CVSS score of 3.7, published 28 October 2025.
Which products and versions are affected?: Keycloak <UNKNOWN>; org.keycloak:keycloak-quarkus-server (Maven) ECOSYSTEM:introduced=0,fixed=26.4.4.
Is there a fix for CVE-2025-10939?: Yes. org.keycloak:keycloak-quarkus-server (Maven): upgrade to 26.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-10939 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-10939?: Check whether you run Keycloak or org.keycloak:keycloak-quarkus-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.keycloak:keycloak-quarkus-server (Maven): upgrade to 26.4.4 or later

# set org.keycloak:keycloak-quarkus-server to 26.4.4 in your pom.xml or build.gradle

Technical details

The vulnerability is a path traversal/normalization bypass in Keycloak's handling of the /admin endpoint when deployed behind a proxy. An attacker can craft relative or non-normalized paths (e.g., accessing the admin console via /realms/../admin or similar techniques) that a proxy like HA-Proxy fails to correctly normalize, allowing access to the /admin application path even when it is configured to be restricted. The attack requires network access to the Keycloak instance and exploits the disconnect between how the proxy and Keycloak normalize request paths. The Keycloak project documentation already recommends not exposing the /admin path externally, indicating this is a known architectural concern. A patch is expected from the Keycloak project to address path handling in proxy scenarios.

Affected products

Keycloak Keycloak <UNKNOWN>

Identifiers

CVE-2025-10939
GHSA-vjr8-56p3-fmqq

Timeline

2025-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.