NetSight
IP …
medium6.1

CVE-2024-8883

Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect

Impact

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.keycloak:keycloak-services<= 22.0.1222.0.13

Affected products

VendorProductAffected versions
RedhatBuild Of Keycloak
All versions
RedhatOpenshift Container Platform
Versions 4.11, 4.12
RedhatOpenshift Container Platform For Ibm Z
Versions 4.9, 4.10
RedhatOpenshift Container Platform For Linuxone
Versions 4.9, 4.10
RedhatOpenshift Container Platform For Power
Versions 4.9, 4.10
RedhatSingle Sign-On
All versions
Version 7.6

Weakness classification

CWE-601

References