What is the CVSS score of CVE-2025-10939?

CVE-2025-10939 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2025-10939?

Yes, a patch is available for CVE-2025-10939. Update the affected software to the latest version immediately.

Keycloak. The Keycloak CVE-2025-10939

LOW

Uncontrolled Search Path Element (CWE-427)

2025-10-28 secalert@redhat.com

Information Disclosure

3.7

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (redhat) · only source for this CVE.

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 01:36 vuln.today

Analysis Generated

Aug 05, 2026 - 01:36 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

22 maven packages depend on org.keycloak:keycloak-quarkus-server (4 direct, 18 indirect)

Ecosystem-wide dependent count for version 26.4.4.

DescriptionCVE.org

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.

AnalysisAI

Path normalization bypass in Keycloak allows unauthenticated network attackers to circumvent reverse proxy access controls protecting the /admin interface by submitting HTTP requests with non-normalized paths (containing .. or //). Proxies such as HAProxy perform literal string matching on the raw request URI and do not block these crafted paths, while Keycloak internally normalizes them to resolve to /admin — effectively defeating the proxy-layer security control. This vulnerability is not in CISA KEV and carries a low EPSS score (0.38%), but is directly relevant to any proxy-protected Keycloak deployment following the vendor's own recommended hardening guidance.