CVE-2024-1132: Keycloak: path transversal in redirection validation

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-17 · updated 2026-08-04
Weakness: CWE-22

Description

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

Affected products

Red Hat build of Keycloak 26.4: all versions
RedHat Jboss Middleware Text-Only Advisories: 1.0
Keycloak: from 21.1.0 before 22.0.10; from 23.0.0 before 24.0.3 — fixed in 22.0.10, 24.0.3
RedHat Migration Toolkit For Applications: 1.0
Red Hat Migration Toolkit for Runtimes: all versions
Red Hat OpenShift Container Platform 4.18: 4.11, 4.12
RedHat Openshift Container Platform For Ibm Z: 4.9, 4.10
RedHat Openshift Container Platform For Linuxone: 4.9, 4.10
RedHat Openshift Container Platform For Power: 4.9, 4.10
Red Hat Single Sign-On: 7.6

How to fix

Upgrade to a fixed version: Keycloak 22.0.10, 24.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1132 or the next vulnerability affects your stack