This vulnerability arises because Keycloak accepts RFC-compliant matrix parameters in URL path segments, but common reverse proxy configurations may mishandle these parameters, allowing crafted requests to mask path segments. This can lead to bypassing proxy-level path filtering and exposure of administrative or sensitive endpoints. The flaw is an improper input validation issue. The CVSS v3.1 score is 3.7 (low), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and low confidentiality impact. Exploitation depends on the reverse proxy configuration. Red Hat advisory emphasizes that internal access controls should be relied upon to protect sensitive endpoints. No patch or fix is explicitly stated in the advisory, and mitigation focuses on access control policies.

The vulnerability allows a remote unauthenticated attacker to bypass reverse proxy path filtering by exploiting how matrix parameters in URL paths are handled. This could expose administrative or sensitive endpoints that operators believe are protected by the proxy. The impact is limited to confidentiality with low severity, as the attacker may gain visibility into endpoints but cannot modify data or affect availability. Exploitation depends on the specific reverse proxy configuration. There is no impact on integrity or availability.

Red Hat advisory states that operators should ensure all administrative and sensitive endpoints in Keycloak are protected by robust authentication and authorization policies independent of reverse proxy path filtering. Review and strengthen internal access controls to restrict access to authorized users and roles. No official patch or fix is currently indicated in the advisory. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.