Keycloak Path Traversal Vulnerability in Vault Key Handling on Windows

A path traversal vulnerability has been identified in Keycloak's vault key management on Windows. The issue arises because the previous fix for CVE-2024-10492 did not consider the Windows file separator, allowing high-privilege administrators to craft vault secret lookups that probe for files outside the expected realm context. This vulnerability represents a platform-specific variant and an incomplete fix of CVE-2024-10492.

Impact

Exploitation of this vulnerability could lead to unauthorized file access, allowing an administrator to read files outside the intended realm context.