Keycloak: vulnerable redirect uri validation results in open redirec

Summary

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Timeline

1. Sep 19, 2024, 3:48 PM UTCCVE published
2. Sep 19, 2024, 5:28 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Aug 4, 2026, 11:08 AM UTCRecord last updated

Affected versions

• keycloak-services

  fixed in 22.0.12; From 23.0.0 · fixed in 24.0.7; From 25.0.0 · fixed in 25.0.5

• keycloak-services

  Version range not reported

• keycloak-services

  Version range not reported

• rhbk/keycloak-operator-bundle

  Version range not reported

• rhbk/keycloak-rhel9

  Version range not reported

• rhbk/keycloak-rhel9-operator

  Version range not reported

• rhbk/keycloak-operator-bundle

  Version range not reported

• rhbk/keycloak-rhel9

  Version range not reported

• rhbk/keycloak-rhel9-operator

  Version range not reported

• Red Hat Red Hat JBoss Enterprise Application Platform 8

  Version range not reported

• Red Hat Red Hat JBoss Enterprise Application Platform 8

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-activemq-artemis

  Version range not reported

• eap8-activemq-artemis-native

  Version range not reported

• eap8-aesh-extensions

  Version range not reported

• eap8-aesh-readline

  Version range not reported

• eap8-apache-commons-codec

  Version range not reported

• eap8-apache-commons-collections

  Version range not reported

• eap8-apache-commons-io

  Version range not reported

• eap8-apache-commons-lang

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-artemis-native

  Version range not reported

• eap8-artemis-wildfly-integration

  Version range not reported

• eap8-asyncutil

  Version range not reported

• eap8-aws-java-sdk

  Version range not reported

• eap8-cryptacular

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-fastinfoset

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-hibernate-validator

  Version range not reported

• eap8-hppc

  Version range not reported

• eap8-insights-java-client

  Version range not reported

• eap8-jakarta-servlet-jsp-jstl-api

  Version range not reported

• eap8-jboss-cert-helper

  Version range not reported

• eap8-jboss-logging

  Version range not reported

• eap8-jctools

  Version range not reported

• eap8-jgroups

  Version range not reported

• eap8-log4j

  Version range not reported

• eap8-narayana

  Version range not reported

• eap8-nimbus-jose-jwt

  Version range not reported

• eap8-objectweb-asm

  Version range not reported

• eap8-pem-keystore

  Version range not reported

• eap8-resteasy-extensions

  Version range not reported

• eap8-resteasy-spring

  Version range not reported

• eap8-saaj-impl

  Version range not reported

• eap8-shibboleth-java-support

  Version range not reported

• eap8-slf4j

  Version range not reported

• eap8-snakeyaml

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-activemq-artemis

  Version range not reported

• eap8-activemq-artemis-native

  Version range not reported

• eap8-aesh-extensions

  Version range not reported

• eap8-aesh-readline

  Version range not reported

• eap8-apache-commons-codec

  Version range not reported

• eap8-apache-commons-collections

  Version range not reported

• eap8-apache-commons-io

  Version range not reported

• eap8-apache-commons-lang

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-artemis-native

  Version range not reported

• eap8-artemis-wildfly-integration

  Version range not reported

• eap8-asyncutil

  Version range not reported

• eap8-aws-java-sdk

  Version range not reported

• eap8-cryptacular

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-fastinfoset

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-hibernate-validator

  Version range not reported

• eap8-hppc

  Version range not reported

• eap8-insights-java-client

  Version range not reported

• eap8-jakarta-servlet-jsp-jstl-api

  Version range not reported

• eap8-jboss-cert-helper

  Version range not reported

• eap8-jboss-logging

  Version range not reported

• eap8-jctools

  Version range not reported

• eap8-jgroups

  Version range not reported

• eap8-log4j

  Version range not reported

• eap8-narayana

  Version range not reported

• eap8-nimbus-jose-jwt

  Version range not reported

• eap8-objectweb-asm

  Version range not reported

• eap8-pem-keystore

  Version range not reported

• eap8-resteasy-extensions

  Version range not reported

• eap8-resteasy-spring

  Version range not reported

• eap8-saaj-impl

  Version range not reported

• eap8-shibboleth-java-support

  Version range not reported

• eap8-slf4j

  Version range not reported

• eap8-snakeyaml

  Version range not reported

• eap8-wildfly

  Version range not reported

• keycloak-services

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso-7/sso76-openshift-rhel8

  Version range not reported

• org.keycloak:keycloak-servicesMaven

  fixed in 22.0.13

• org.keycloak:keycloak-servicesMaven

  From 23.0.0 · fixed in 24.0.8

• org.keycloak:keycloak-servicesMaven

  From 25.0.0 · fixed in 25.0.6

References 18