CVE-2024-8883: Keycloak Open Redirect vulnerability
(updated )
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a ‘Valid Redirect URI’ is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
References
- access.redhat.com/errata/RHSA-2024:6878
- access.redhat.com/errata/RHSA-2024:6879
- access.redhat.com/errata/RHSA-2024:6880
- access.redhat.com/errata/RHSA-2024:6882
- access.redhat.com/errata/RHSA-2024:6886
- access.redhat.com/errata/RHSA-2024:6887
- access.redhat.com/errata/RHSA-2024:6888
- access.redhat.com/errata/RHSA-2024:6889
- access.redhat.com/errata/RHSA-2024:6890
- access.redhat.com/security/cve/CVE-2024-8883
- bugzilla.redhat.com/show_bug.cgi?id=2312511
- github.com/advisories/GHSA-vvf8-2h68-9475
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
- github.com/keycloak/keycloak/releases/tag/25.0.6
- nvd.nist.gov/vuln/detail/CVE-2024-8883
Detect and mitigate CVE-2024-8883 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →