~ / search / GHSA-w8gr-xwp4-r9f7

GHSA-w8gr-xwp4-r9f7

Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-8883

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 22.0.13 22.0.13
Maven org.keycloak:keycloak-services >= 23.0.0, < 24.0.8 24.0.8
Maven org.keycloak:keycloak-services >= 25.0.0, < 25.0.6 25.0.6

Details

As written in the advisory (Markdown source, shown as plain text).

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

References

External links from the advisory. They lead to third-party sites.