CVE-2024-1132
HIGH
MEDIUM
Priority: 0.13
BB Relevance:
67/100
Published: 2024-04-17
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
None
Description
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
Weakness Classification (1)
Affected Software (17)
| Vendor | Product | Version |
|---|---|---|
| — | — | 21.1.0 < 22.0.10 |
| — | — | 23.0.0 < 24.0.3 |
| redhat | build_of_keycloak | - |
| redhat | jboss_middleware_text-only_advisories | 1.0 |
| redhat | keycloak | 21.1.0 – 22.0.10 |
| redhat | migration_toolkit_for_applications | 1.0 |
| redhat | migration_toolkit_for_runtimes | - |
| redhat | openshift_container_platform | 4.11 |
| redhat | openshift_container_platform | 4.12 |
| redhat | openshift_container_platform_for_ibm_z | 4.9 |
| redhat | openshift_container_platform_for_ibm_z | 4.10 |
| redhat | openshift_container_platform_for_linuxone | 4.9 |
| redhat | openshift_container_platform_for_linuxone | 4.10 |
| redhat | openshift_container_platform_for_power | 4.9 |
| redhat | openshift_container_platform_for_power | 4.10 |
| redhat | single_sign-on | - |
| redhat | single_sign-on | 7.6 |
References & Advisories (14)
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Vendor Advisory
Issue Tracking
Vendor Advisory