PT-2026-41879 · Red Hat · Keycloak
Duarte Antunes
+1
·
Published
2026-05-19
·
Updated
2026-06-03
·
CVE-2026-7504
CVSS v2.0
9.4
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Keycloak (affected versions not specified)
Description
A flaw in the URL validation logic during redirect operations allows an attacker to bypass validation and redirect users to unauthorized URLs. This occurs when Keycloak clients are configured with a wildcard (*) in the "Valid Redirect URIs" field. The issue arises from a discrepancy between Keycloak and the Java URI implementation regarding the handling of the user-info component of a URL. Specifically, if a redirect URL contains multiple @ characters in the user-info section, the Java URI parser fails to extract the user-info, causing Keycloak to fall back to a wildcard comparison and incorrectly permit the redirect. Successful exploitation requires user interaction.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Keycloak