Vulnerability GHSA-vjr8-56p3-fmqq
Low Risk
LOW RISK
CVSS Score: 3.7
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
11 months ago
December 02, 2025 at 01:21 AM UTC
Keycloak unable to restrict access to the admin console
12.0.0 - 26.4.3
12.0.0 - 26.4.3
Summary
Keycloak unable to restrict access to the admin console
Details
A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
8 months ago
Keycloak logs sensitive headers
12.0.0 - 26.5.5 GHSA-gv3v-2cpp-3pmq
12.0.0 - 26.5.5 GHSA-gv3v-2cpp-3pmq
Low Risk
9 months ago
Keycloak has an improper input validation vulnerability
12.0.0 - 26.2.5 GHSA-v897-pv23-r8cw
12.0.0 - 26.2.5 GHSA-v897-pv23-r8cw
Medium Risk
1 year ago
Keycloak on Quarkus CLI option for encrypted JGroups ignored
25.0.0 - 26.0.5 GHSA-g6qq-c9f9-2772
25.0.0 - 26.0.5 GHSA-g6qq-c9f9-2772
Medium Risk
1 year ago
Denial of Service in Keycloak Server via Security Headers
12.0.0 - 26.0.7 GHSA-w3g8-r9gw-qrh8
12.0.0 - 26.0.7 GHSA-w3g8-r9gw-qrh8
Medium Risk
1 year ago
Keycloak allows unrestricted admin use of system and environment variables
12.0.0 - 26.0.7 GHSA-f4v7-3mww-9gc2
12.0.0 - 26.0.7 GHSA-f4v7-3mww-9gc2
Impacted packages
Timeline
Published
11 months ago
December 02, 2025 at 01:21 AM UTC
Fixed (26.4.4)
Unknown
Unknown
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC