CVE-2024-10039: Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
Summary
CVE-2024-10039: Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination. Affects org.keycloak:keycloak-core versions < 26.0.6. Fixed in 26.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows users to secure applications and services with little to no code. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. Keycloak is widely used for managing user identities and access in modern applications. However, certain deployment configurations, particularly those involving reverse proxies, can expose Keycloak to vulnerabilities, such as the one described here.
Vulnerability Detail
A vulnerability exists in Keycloak when deployed with a reverse proxy that does not use pass-through termination of TLS while mTLS is enabled. This flaw allows an attacker on the local network to potentially authenticate as any user or client that relies on mTLS for authentication. The lack of proper TLS termination can lead to unauthorized access and compromise the integrity of the authentication process, making it a significant security risk.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.0.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if you cannot update Keycloak immediately, consider configuring your reverse proxy to use pass-through termination of TLS. This configuration ensures that the TLS connection is maintained all the way to the Keycloak server, preventing the vulnerability from being exploited.
Conclusion
The CVE-2024-10039 vulnerability in Keycloak poses a significant risk for deployments using reverse proxies without proper TLS termination. It is crucial to update to the patched version 26.0.6 or later to mitigate this risk. Additionally, implementing workarounds such as pass-through TLS termination can provide temporary relief until the update is applied.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
mTLS, or mutual TLS, is a security protocol that requires both the client and server to authenticate each other during the TLS handshake, providing an additional layer of security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could allow unauthorized users to gain access to sensitive resources, potentially leading to data breaches and loss of user trust.
Yes, tools like Vulert can monitor your project's pom.xml file for open-source vulnerabilities in real-time, alerting you to any issues.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
