Skip to content
Fencer Vulns
medium 6.1

CVE-2024-8883 json

Keycloak: vulnerable redirect uri validation results in open redirec

published 2024-09-19 2 y ago modified 2026-11-03 6 d ago also GHSA-w8gr-xwp4-r9f7 , EUVD-2024-3152

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known, plus a Nuclei check

Summary

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Patch / fix

  • maven org.keycloak:keycloak-services 22.0.13, 24.0.8, 25.0.6
  • Red Hat Red Hat build of Keycloak 22 22-18, 22-21, 22.0.13-1
  • Red Hat Red Hat build of Keycloak 24 24-17, 24.0.8-1
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:0.1.0-2.redhat_00010.1.el8eap, 0:0.8.1-2.redhat_00001.1.el8eap, 0:1.2.5-2.redhat_00001.1.el8eap, 0:1.8.0-2.redhat_00001.1.el8eap, 0:1.12.284-2.redhat_00002.1.el8eap, 0:1.16.1-2.redhat_00007.1.el8eap, 0:2.0.1-1.redhat_00002.1.el8eap, 0:2.1.0-4.redhat_00001.1.el8eap, 0:2.2.0-2.redhat_00001.1.el8eap, 0:2.15.1-1.redhat_00001.1.el8eap, 0:2.33.0-1.redhat_00015.1.el8eap, 0:3.2.2-28.redhat_2.1.el8eap, 0:3.14.0-2.redhat_00006.1.el8eap, 0:4.0.5-1.redhat_00001.1.el8eap, 0:6.2.31-1.Final_redhat_00002.1.el8eap, 0:8.0.1-3.Final_redhat_00001.1.el8eap, 0:8.0.4-3.GA_redhat_00007.1.el8eap, 0:800.4.0-1.GA_redhat_00001.1.el8eap, 0:800.4.1-1.GA_redhat_00001.1.el8eap, 1:2.0.0-2.redhat_00005.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:0.1.0-2.redhat_00010.1.el9eap, 0:0.8.1-2.redhat_00001.1.el9eap, 0:1.2.5-2.redhat_00001.1.el9eap, 0:1.8.0-2.redhat_00001.1.el9eap, 0:1.12.284-2.redhat_00002.1.el9eap, 0:1.16.1-2.redhat_00007.1.el9eap, 0:2.0.1-1.redhat_00002.1.el9eap, 0:2.1.0-4.redhat_00001.1.el9eap, 0:2.2.0-2.redhat_00001.1.el9eap, 0:2.15.1-1.redhat_00001.1.el9eap, 0:2.33.0-1.redhat_00015.1.el9eap, 0:3.2.2-28.redhat_2.1.el9eap, 0:3.14.0-2.redhat_00006.1.el9eap, 0:4.0.5-1.redhat_00001.1.el9eap, 0:6.2.31-1.Final_redhat_00002.1.el9eap, 0:8.0.1-3.Final_redhat_00001.1.el9eap, 0:8.0.4-3.GA_redhat_00007.1.el9eap, 0:800.4.0-1.GA_redhat_00001.1.el9eap, 0:800.4.1-1.GA_redhat_00001.1.el9eap, 1:2.0.0-2.redhat_00005.1.el9eap
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 0:18.0.18-1.redhat_00001.1.el7sso
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 0:18.0.18-1.redhat_00001.1.el8sso
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 0:18.0.18-1.redhat_00001.1.el9sso
  • Red Hat RHEL-8 based Middleware Containers 7.6-54
  • eap8-hppc jboss enterprise application platform 8.0 0.8.1-2.redhat_00001.1.el8eap
  • eap8-log4j jboss enterprise application platform 8.0 2.22.1-1.redhat_00002.1.el8eap
  • eap8-slf4j jboss enterprise application platform 8.0 2.0.16-1.redhat_00001.1.el8eap
  • eap8-jctools jboss enterprise application platform 8.0 4.0.2-1.redhat_00001.1.el8eap
  • eap8-jgroups jboss enterprise application platform 8.0 5.3.10-1.Final_redhat_00001.1.el8eap
  • eap8-wildfly jboss enterprise application platform 8.0 8.0.4-2.GA_redhat_00005.1.el8eap
  • eap8-narayana jboss enterprise application platform 8.0 6.0.3-1.Final_redhat_00001.1.el8eap
  • eap8-asyncutil jboss enterprise application platform 8.0 0.1.0-2.redhat_00010.1.el8eap

red hat advisories RHSA-2024:8823RHSA-2024:10386RHSA-2024:8824RHSA-2024:6880RHSA-2024:6879RHSA-2024:6878

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-8883 updated cvss 6.1

Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec

  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-54
    fixed: vendor fix RHSA-2024:6882
  • Red Hat Build of Keycloak
    fixed: vendor fix RHSA-2024:6890
  • Red Hat build of Keycloak 22 rhbk/keycloak-rhel9 22-18, rhbk/keycloak-rhel9-operator 22-21, rhbk/keycloak-operator-bundle 22.0.13-1
    fixed: vendor fix RHSA-2024:6887
  • Red Hat build of Keycloak 24 rhbk/keycloak-rhel9 24-17, rhbk/keycloak-rhel9-operator 24-17, rhbk/keycloak-operator-bundle 24.0.8-1
    fixed: vendor fix RHSA-2024:6889
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-hppc 0.8.1-2.redhat_00001.1.el8eap, eap8-log4j 2.22.1-1.redhat_00002.1.el8eap, eap8-slf4j 2.0.16-1.redhat_00001.1.el8eap, eap8-jctools 4.0.2-1.redhat_00001.1.el8eap, eap8-asyncutil 0.1.0-2.redhat_00010.1.el8eap, eap8-saaj-impl 3.0.4-1.redhat_00001.1.el8eap, +81 more
    fixed: vendor fix RHSA-2024:8823
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-hppc 0.8.1-2.redhat_00001.1.el9eap, eap8-log4j 2.22.1-1.redhat_00002.1.el9eap, eap8-slf4j 2.0.16-1.redhat_00001.1.el9eap, eap8-jctools 4.0.2-1.redhat_00001.1.el9eap, eap8-asyncutil 0.1.0-2.redhat_00010.1.el9eap, eap8-saaj-impl 3.0.4-1.redhat_00001.1.el9eap, +81 more
    fixed: vendor fix RHSA-2024:10386
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix RHSA-2024:8826
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2024:6886
show 3 more
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.18-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.18-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2024:6878
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.18-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.18-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2024:6879
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.18-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.18-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2024:6880

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

2.11% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.keycloak:keycloak-services
<22.0.13
>=23.0.0, <24.0.8
>=25.0.0, <25.0.6
22.0.13
24.0.8
25.0.6

Affected products

  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat build of Keycloak 22
  • Red Hat Red Hat build of Keycloak 24
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 7
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 8
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 9
  • Red Hat RHEL-8 based Middleware Containers

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.