CVE-2024-8883: Keycloak: vulnerable redirect uri validation results in open redirec

Description

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

keycloak-services

Default version status: unaffected

0 to < 22.0.12affected
23.0.0 to < 24.0.7affected
25.0.0 to < 25.0.5affected

Red Hat Red Hat Build of Keycloak

Default version status: unaffected

Red Hat Red Hat Build of Keycloak

Default version status: unaffected

Red Hat Red Hat build of Keycloak 22

Default version status: affected

22.0.13-1 to < *unaffected

Red Hat Red Hat build of Keycloak 22

Default version status: affected

22-18 to < *unaffected

Red Hat Red Hat build of Keycloak 22

Default version status: affected

22-21 to < *unaffected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

24.0.8-1 to < *unaffected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

24-17 to < *unaffected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

24-17 to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:800.4.1-1.GA_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:8.0.4-3.GA_redhat_00007.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.33.0-1.redhat_00015.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

1:2.0.0-2.redhat_00005.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:1.8.0-2.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.2.0-2.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:1.16.1-2.redhat_00007.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:3.2.2-28.redhat_2.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.15.1-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:3.14.0-2.redhat_00006.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:4.0.5-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

1:2.0.0-2.redhat_00005.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.0.1-1.redhat_00002.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:0.1.0-2.redhat_00010.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:1.12.284-2.redhat_00002.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:1.2.5-2.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:800.4.0-1.GA_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.1.0-4.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:6.2.31-1.Final_redhat_00002.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:8.0.1-3.Final_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:0.8.1-2.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:1.1.3-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:3.0.1-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:1.1.3-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:3.5.3-1.Final_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:4.0.2-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:5.3.10-1.Final_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.22.1-1.redhat_00002.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:6.0.3-1.Final_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:9.37.3-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:9.6.0-1.redhat_00002.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.3.0-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.0.1-3.Final_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:3.0.1-2.Final_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:3.0.4-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:8.0.0-6.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.0.16-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:2.2.0-1.redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Default version status: affected

0:8.0.4-2.GA_redhat_00005.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:800.4.1-1.GA_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:8.0.4-3.GA_redhat_00007.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.33.0-1.redhat_00015.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

1:2.0.0-2.redhat_00005.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:1.8.0-2.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.2.0-2.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:1.16.1-2.redhat_00007.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:3.2.2-28.redhat_2.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.15.1-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:3.14.0-2.redhat_00006.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:4.0.5-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

1:2.0.0-2.redhat_00005.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.0.1-1.redhat_00002.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:0.1.0-2.redhat_00010.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:1.12.284-2.redhat_00002.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:1.2.5-2.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:800.4.0-1.GA_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.1.0-4.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:6.2.31-1.Final_redhat_00002.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:8.0.1-3.Final_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:0.8.1-2.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:1.1.3-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:3.0.1-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:1.1.3-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:3.5.3-1.Final_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:4.0.2-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:5.3.10-1.Final_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.22.1-1.redhat_00002.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:6.0.3-1.Final_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:9.37.3-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:9.6.0-1.redhat_00002.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.3.0-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.0.1-3.Final_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:3.0.1-2.Final_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:3.0.4-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:8.0.0-6.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.0.16-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:2.2.0-1.redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Default version status: affected

0:8.0.4-2.GA_redhat_00005.1.el9eap to < *unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 7

Default version status: affected

0:18.0.18-1.redhat_00001.1.el7sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 8

Default version status: affected

0:18.0.18-1.redhat_00001.1.el8sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 9

Default version status: affected

0:18.0.18-1.redhat_00001.1.el9sso to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

7.6-54 to < *unaffected