What’s Vulnerable › Vulnerabilities

CVE-2023-6291: Keycloak: redirect_uri validation bypass

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-26 · updated 2026-09-22
• Weakness: CWE-601

Description

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

Affected products

• Keycloak: before 22.0.7 — fixed in 22.0.7
• RedHat Migration Toolkit For Applications: 6.0, 7.0
• Red Hat OpenShift Container Platform 4.18: 4.11, 4.12
• RedHat Openshift Container Platform For Ibm Z: 4.9, 4.10
• RedHat Openshift Container Platform For Linuxone: 4.9, 4.10
• RedHat Openshift Container Platform For Power: 4.9, 4.10
• Red Hat Single Sign-On: 7.6

How to fix

Upgrade to a fixed version: Keycloak 22.0.7. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2023:7854
• https://access.redhat.com/errata/RHSA-2023:7855
• https://access.redhat.com/errata/RHSA-2023:7856
• https://access.redhat.com/errata/RHSA-2023:7857
• https://access.redhat.com/errata/RHSA-2023:7858
• https://access.redhat.com/errata/RHSA-2023:7860
• https://access.redhat.com/errata/RHSA-2023:7861
• https://access.redhat.com/errata/RHSA-2024:0798
• https://access.redhat.com/errata/RHSA-2024:0799
• https://access.redhat.com/errata/RHSA-2024:0800
• https://access.redhat.com/errata/RHSA-2024:0801
• https://access.redhat.com/errata/RHSA-2024:0804

Get alerted when CVE-2023-6291 or the next vulnerability affects your stack