Keycloak accepts RFC-compliant matrix parameters in URL path segments. When a reverse proxy does not preserve or properly handle these parameters, an attacker can craft requests that hide privileged path segments, thereby bypassing proxy-level path filtering. The vulnerability is an input validation flaw (CWE‑20) that allows a remote attacker to send a single HTTP request containing matrix parameters to a Keycloak instance and potentially reach endpoints that operators assume are not externally reachable.

Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 8, and Red Hat JBoss Enterprise Application Platform Expansion Pack are affected. No specific version ranges are listed, so all installed instances of these products should be evaluated for exposure to this issue.

The CVSS base score is 3.7, indicating low severity. Exploitation requires only remote access to transmit a crafted request. The EPSS score is below 1 %, suggesting that exploitation attempts are rare. The vulnerability is not listed in the CISA KEV catalog. Because the attack can be performed over the public network, operators should address the weakness if their protective controls for administrative endpoints are insufficient.