A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path the outside case installation is using a proxy. issue occurs at least via ha-proxy, as it can be tricked relative/non-normalized paths access application relative /realms which expected exposed.