CVE-2025-10043 – Keycloak: incomplete fix of cve-2024-10492

CVE ID : CVE-2025-10043

Published : Sept. 5, 2025, 8:15 p.m. | 1 hour ago

Description : A path traversal validation flaw exists in Keycloak’s vault key handling on Windows. The previous fix for CVE-2024-10492 did not account for the Windows file separator (). As a result, a high-privilege administrator could probe for the existence of files outside the expected realm context through crafted vault secret lookups. This is a platform-specific variant/incomplete fix of CVE-2024-10492.

Severity: 2.7 | LOW

Visit the link for more details, such as CVSS details, affected products, timeline, and more…