VDB
Sign up
LOW3.7

GHSA-vjr8-56p3-fmqq

Keycloak unable to restrict access to the admin console

Quick fix

GHSA-vjr8-56p3-fmqq — org.keycloak:keycloak-quarkus-server: upgrade to the fixed version with the command below.

# pom.xml: bump <version>26.4.4</version> for org.keycloak:keycloak-quarkus-server

Details

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.keycloak:keycloak-quarkus-server
Introduced in: 0Fixed in: 26.4.4
Fix# pom.xml: bump <version>26.4.4</version> for org.keycloak:keycloak-quarkus-server

References