Riskcovery

CVE-2024-2419

Keycloak: path traversal in the redirect validation

State
Published
Severity
7.1 High
Published
Apr 17, 2024
Updated
Nov 11, 2025
Reserved
Mar 13, 2024

Read the record on cve.org

Description

A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Lredhat

Weaknesses

  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

ProductVersions
keycloak
  • before 22.0.10Affected
  • 23.0.0 to before 24.0.3Affected
Red Hat build of Keycloak 22Red Hat
  • 22.0.10-1 and laterNot affected
Red Hat build of Keycloak 22Red Hat
  • 22-13 and laterNot affected
Red Hat build of Keycloak 22Red Hat
  • 22-16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.