A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| redhat | build_of_keycloak | - | - |
| redhat | openshift_container_platform | - | - |
| redhat | openshift_container_platform |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
11
Affected Products
17
References
redhat / build_of_keycloak
| - |
| - |
| redhat | openshift_container_platform_for_ibm_z | - | - |
| redhat | openshift_container_platform_for_ibm_z | - | - |
| redhat | openshift_container_platform_for_linuxone | - | - |
| redhat | openshift_container_platform_for_linuxone | - | - |
| redhat | openshift_container_platform_for_power | - | - |
| redhat | openshift_container_platform_for_power | - | - |
| redhat | single_sign-on | - | - |
| redhat | single_sign-on | - | - |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability
Impact