A path traversal validation flaw exists in Keycloak’s vault key handling on Windows. The previous fix for CVE-2024-10492 did not account for the Windows file separator (\). As a result, a high-privilege administrator could probe for the existence of files outside the expected realm context through crafted vault secret lookups. This is a platform-specific variant/incomplete fix of CVE-2024-10492.
I ran into a similar situation with another Java application where the path separator checks between Windows (\) https://grannygame.org/ and Linux (/) were not in sync, leading to bypass validation. The lesson learned is to always normalize the path before applying whitelists or boundary checks. For Keycloak, this is probably the long-term solution instead of patching each platform individually.