CVE-2024-8883

Keycloak: vulnerable redirect uri validation results in open redirec

State: Published
Severity: 6.1 Medium
Published: Sep 19, 2024
Updated: Aug 4, 2026
Reserved: Sep 16, 2024

Description

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	redhat

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
keycloak-services	before 22.0.12Affected 23.0.0 to before 24.0.7Affected 25.0.0 to before 25.0.5Affected
Red Hat Build of KeycloakRed Hat
Red Hat Build of KeycloakRed Hat
Red Hat build of Keycloak 22Red Hat	22.0.13-1 and laterNot affected
Red Hat build of Keycloak 22Red Hat	22-18 and laterNot affected
Red Hat build of Keycloak 22Red Hat	22-21 and laterNot affected
Red Hat build of Keycloak 24Red Hat	24.0.8-1 and laterNot affected
Red Hat build of Keycloak 24Red Hat	24-17 and laterNot affected
Red Hat build of Keycloak 24Red Hat	24-17 and laterNot affected
Red Hat JBoss Enterprise Application Platform 8Red Hat
Red Hat JBoss Enterprise Application Platform 8Red Hat
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:800.4.1-1.GA_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:8.0.4-3.GA_redhat_00007.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.33.0-1.redhat_00015.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	1:2.0.0-2.redhat_00005.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:1.8.0-2.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.2.0-2.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:1.16.1-2.redhat_00007.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.2.2-28.redhat_2.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.15.1-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.14.0-2.redhat_00006.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:4.0.5-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	1:2.0.0-2.redhat_00005.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.0.1-1.redhat_00002.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:0.1.0-2.redhat_00010.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:1.12.284-2.redhat_00002.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:1.2.5-2.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:800.4.0-1.GA_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.1.0-4.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:6.2.31-1.Final_redhat_00002.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:8.0.1-3.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:0.8.1-2.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:1.1.3-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.0.1-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:1.1.3-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.5.3-1.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:4.0.2-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:5.3.10-1.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.22.1-1.redhat_00002.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:6.0.3-1.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:9.37.3-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:9.6.0-1.redhat_00002.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.3.0-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.0.1-3.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.0.1-2.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.0.4-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:8.0.0-6.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.0.16-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.2.0-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:8.0.4-2.GA_redhat_00005.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:800.4.1-1.GA_redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:8.0.4-3.GA_redhat_00007.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.33.0-1.redhat_00015.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	1:2.0.0-2.redhat_00005.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:1.8.0-2.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.2.0-2.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:1.16.1-2.redhat_00007.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:3.2.2-28.redhat_2.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.15.1-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:3.14.0-2.redhat_00006.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:4.0.5-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	1:2.0.0-2.redhat_00005.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.0.1-1.redhat_00002.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:0.1.0-2.redhat_00010.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:1.12.284-2.redhat_00002.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:1.2.5-2.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:800.4.0-1.GA_redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.1.0-4.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:6.2.31-1.Final_redhat_00002.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:8.0.1-3.Final_redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:0.8.1-2.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:1.1.3-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:3.0.1-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:1.1.3-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:3.5.3-1.Final_redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:4.0.2-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:5.3.10-1.Final_redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.22.1-1.redhat_00002.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:6.0.3-1.Final_redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:9.37.3-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:9.6.0-1.redhat_00002.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.3.0-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.0.1-3.Final_redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:3.0.1-2.Final_redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:3.0.4-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:8.0.0-6.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.0.16-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:2.2.0-1.redhat_00001.1.el9eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Red Hat	0:8.0.4-2.GA_redhat_00005.1.el9eap and laterNot affected
Red Hat Single Sign-On 7Red Hat
Red Hat Single Sign-On 7.6 for RHEL 7Red Hat	0:18.0.18-1.redhat_00001.1.el7sso and laterNot affected
Red Hat Single Sign-On 7.6 for RHEL 8Red Hat	0:18.0.18-1.redhat_00001.1.el8sso and laterNot affected
Red Hat Single Sign-On 7.6 for RHEL 9Red Hat	0:18.0.18-1.redhat_00001.1.el9sso and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.6-54 and laterNot affected

References

RHSA-2024:10385vendor-advisory
RHSA-2024:10386vendor-advisory
RHSA-2024:6878vendor-advisory
RHSA-2024:6879vendor-advisory
RHSA-2024:6880vendor-advisory
RHSA-2024:6882vendor-advisory
RHSA-2024:6886vendor-advisory
RHSA-2024:6887vendor-advisory
RHSA-2024:6888vendor-advisory
RHSA-2024:6889vendor-advisory
RHSA-2024:6890vendor-advisory
RHSA-2024:8823vendor-advisory
RHSA-2024:8824vendor-advisory
RHSA-2024:8826vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-8883vdb-entry
RHBZ#2312511issue-tracking
https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.