GitHub Advisoryadvisory · Maven

GHSA-w8gr-xwp4-r9f7 Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect

MEDIUM Published 2024-10-14 Modified 2024-12-20 Official page ↗
Aliases
CVE-2024-8883
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2024-10-14

Affected packages

• Maven org.keycloak:keycloak-services: < 22.0.13 → fixed in 22.0.13 • Maven org.keycloak:keycloak-services: >= 23.0.0, < 24.0.8 → fixed in 24.0.8 • Maven org.keycloak:keycloak-services: >= 25.0.0, < 25.0.6 → fixed in 25.0.6

Description

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Related

Alias · CVE (1)

  • CVE-2024-8883 A misconfiguration flaw was found in Keycloak. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References