CVE-2024-8883
Keycloak: vulnerable redirect uri validation results in open redirec
MEDIUM 6.1EPSS 2.1%
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
- Affected
- Red Hat · keycloak-services · Red Hat build of Keycloak 22 · Red Hat build of Keycloak 24 · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 · Red Hat Single Sign-On 7.6 for RHEL 7
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS
- 2.11% chance of exploitation in the next 30 days, 82nd percentile
- Nuclei
- medium · CWE-601
- Published
- 2024-09-19
- Updated
- 2026-08-04
Nuclei templates (1)
Security advisories
- https://access.redhat.com/errata/RHSA-2024:6878
- https://access.redhat.com/errata/RHSA-2024:6879
- https://access.redhat.com/errata/RHSA-2024:6880
- https://access.redhat.com/errata/RHSA-2024:6882
- https://access.redhat.com/errata/RHSA-2024:6886
- https://access.redhat.com/errata/RHSA-2024:6887
- https://access.redhat.com/errata/RHSA-2024:6888
- https://access.redhat.com/errata/RHSA-2024:6889
- https://access.redhat.com/errata/RHSA-2024:6890
- https://access.redhat.com/security/cve/CVE-2024-8883
- https://bugzilla.redhat.com/show_bug.cgi?id=2312511
- advisories/GHSA-w8gr-xwp4-r9f7
- keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/Redir…