Описание
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Отчет
This is an Important information disclosure flaw in Keycloak's redirect_uri validation logic. An attacker controlling another path on the same web server could bypass allowed paths in wildcard redirect_uri configurations, potentially leading to access token theft. This affects Red Hat Build of Keycloak (RHBK) versions rhbk-26.2 and rhbk-26.4. Red Hat Build of Keycloak (RHBK) version rhbk-26 is not affected.
Меры по смягчению последствий
To mitigate this vulnerability, avoid using wildcards in redirect_uri configurations within Keycloak. Restricting redirect_uri to explicit, fully qualified URIs prevents the bypass of validation logic. This configuration change may require a service restart or reload to take effect.
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
A flaw was found in Keycloak. This issue allows an attacker, who contr ...
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
EPSS
7.3 High
CVSS3