Listen to this Post
The vulnerability in Keycloak involves a bypass of access controls to the admin console through proxy misconfiguration. Keycloak’s documentation advises not exposing the /admin path externally when using a proxy. However, with certain proxies like ha-proxy, path normalization flaws allow attackers to use relative or non-normalized paths. Specifically, requests to paths like /realms/../admin can trick the proxy. The proxy may evaluate /realms as the accessible path, while the backend resolves it to /admin. This occurs because ha-proxy might not normalize paths before applying access rules. Attackers craft HTTP requests with directory traversal sequences. The backend Keycloak server processes these as valid, granting access to the admin console. This bypass relies on improper proxy configuration where path-based filtering is used. The proxy must be configured to block /admin but fails to handle path manipulations. The issue is specific to ha-proxy but may affect other proxies with similar behavior. Keycloak itself does not mitigate these path traversal attempts at the proxy level. The vulnerability requires the admin console to be indirectly exposed via /realms. Attackers need network access to the proxy endpoint. Successful exploitation leads to unauthorized access to the admin interface. However, additional authentication may still be required on the console. The severity is low due to dependency on proxy setup and configuration. It emphasizes the need for secure proxy practices and path normalization.
Platform: Keycloak
Version: Before 26.4.4
Vulnerability: Access restriction bypass
Severity: Low
date: Dec 1 2025
Prediction: Patch date Dec 2 2025
What Undercode Say:
Analytics:
curl -v http://target/realms/../admin
haproxy -c -f /etc/haproxy/haproxy.cfg
grep -r “acl admin_path” /etc/haproxy/
cat << EOF > test_config.cfg
frontend http_in
bind :80
acl admin_path path_beg /admin
http-request deny if admin_path
use_backend keycloak_backend
backend keycloak_backend
server keycloak localhost:8080
EOF
python3 -c “import requests; r=requests.get(‘http://target/realms/../admin’); print(r.status_code)”
nmap -p 80 –script http-vuln-cve2025- target
how Exploit:
Craft URL with /realms/../admin
Bypass proxy path rules
Access admin console
Use directory traversal sequences
Send HTTP requests directly
Protection from this CVE:
Update to version 26.4.4
Normalize paths in proxy
Block relative paths
Use strict ACLs
Audit proxy configurations
Impact:
Unauthorized admin access
Potential privilege escalation
Security misconfiguration exposure
Increased attack surface
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
