{"id":"CVE-2024-8883","published":"2024-09-19T15:48:28Z","modified":"2026-08-04T11:08:07Z","title":"Keycloak: vulnerable redirect uri validation results in open redirec","vendor":"Red Hat","product":"Red Hat Build of Keycloak","tier":"core","eol":null,"affectedVersions":[{"vendor":null,"product":null,"versions":["< 22.0.12",">= 23.0.0, < 24.0.7",">= 25.0.0, < 25.0.5"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 22","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 22","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 22","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 24","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 24","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 24","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":["all versions"]}],"description":{"text":"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02112,"percentile":0.81758,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-01-08","exploitedFirstSeen":"2026-01-08","ransomware":false,"evidence":[{"url":"https://aws.amazon.com/blogs/security/real-time-malware-defense-leveraging-aws-network-firewall-active-threat-defense/","date":"2026-01-08"},{"url":"https://www.labs.greynoise.io/grimoire/2026-01-24-weekly-oast-report/","date":"2026-01-24"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Real-time malware defense: Leveraging AWS Network Firewall active threat defense","url":"https://otx.alienvault.com/pulse/69620a62af4fb2efb50e852e","created":"2026-01-10"},{"name":"ACTUALIZACION | Red Hat JBoss Enterprise Application Platform 8.0.4 Security update","url":"https://otx.alienvault.com/pulse/672cd2330ebf7b95742fdd4c","created":"2024-11-07"}],"provenance":"machine"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:10385","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10386","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6878","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6879","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6880","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6882","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6886","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6887","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6888","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6889","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6890","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8823","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8824","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8826","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8883","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2312511","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":["<22.0.13",">=23.0.0, <24.0.8",">=25.0.0, <25.0.6"],"patched":["22.0.13","24.0.8","25.0.6"],"from":["GHSA-w8gr-xwp4-r9f7"],"provenance":"source"}],"advisories":[{"id":"GHSA-w8gr-xwp4-r9f7","url":"https://github.com/advisories/GHSA-w8gr-xwp4-r9f7","severity":"MODERATE","ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":["<22.0.13"],"patched":["22.0.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-w8gr-xwp4-r9f7","url":"https://github.com/advisories/GHSA-w8gr-xwp4-r9f7","severity":"MODERATE","ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":[">=23.0.0, <24.0.8"],"patched":["24.0.8"],"provenance":"source","from":"GHSA"},{"id":"GHSA-w8gr-xwp4-r9f7","url":"https://github.com/advisories/GHSA-w8gr-xwp4-r9f7","severity":"MODERATE","ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":[">=25.0.0, <25.0.6"],"patched":["25.0.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-3152","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3152","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2024-8883","name":"Keycloak - Open Redirect","severity":"medium","path":"http/cves/2024/CVE-2024-8883.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8883.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-09-19","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-8883","provenance":"source"},{"date":"2026-01-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://aws.amazon.com/blogs/security/real-time-malware-defense-leveraging-aws-network-firewall-active-threat-defense/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 295 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.35,"detail":"percentile 0.8176"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":4.27,"detail":"base score 6.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2024-4540","published":"2024-06-03","fixed":"24.0.5","kev":false},{"cve":"CVE-2024-4629","published":"2024-09-03","fixed":"25.0.4","kev":false},{"cve":"CVE-2024-7341","published":"2024-09-09","fixed":"25.0.5","kev":false,"link":{"from":"CVE-2024-7341","to":"CVE-2024-8883","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"22.0.12","toFixed":"22.0.13","daysApart":10},{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"24.0.7","toFixed":"24.0.8","daysApart":10}]}},{"cve":"CVE-2024-8883","published":"2024-09-19","fixed":"25.0.6","kev":false},{"cve":"CVE-2025-12390","published":"2025-10-28","fixed":"26.0.0","kev":false},{"cve":"CVE-2024-10270","published":"2024-11-25","fixed":"26.0.6","kev":false,"link":{"from":"CVE-2024-8883","to":"CVE-2024-10270","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"24.0.8","toFixed":"24.0.9","daysApart":67}]}},{"cve":"CVE-2025-1391","published":"2025-02-17","fixed":"26.1.3","kev":false}],"package":"Maven:org.keycloak:keycloak-services"}}