Keycloak Open Redirect vulnerability
Moderate severity
GitHub Reviewed
Published
Sep 19, 2024
to the GitHub Advisory Database
•
Updated Sep 19, 2024
Description
Published by the National Vulnerability Database
Sep 19, 2024
Published to the GitHub Advisory Database
Sep 19, 2024
Reviewed
Sep 19, 2024
Last updated
Sep 19, 2024
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
References