Description

Source:

https://bugzilla.redhat.com/show_bug.cgi?id=2369601
https://issues.redhat.com/browse/SSE-177

An information disclosure vulnerability has been identified in Red Hat build of Keycloak . The /admin/serverinfo endpoint contains internal server details and returns a 401 Unauthorized error when an authenticated user attempts to access it directly.

However, the vulnerability occurs when an authenticated user logs into the system or accesses the admin console. The user's browser automatically sends a request to the /admin/serverinfo endpoint. includes sensitive server information. This response can be captured and viewed using browser developer tools or an HTTP proxy, thereby allowing any authenticated user to unintentionally access these internal server details.