CVE-2023-6291
published 2024-01-26CVE-2023-6291: A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may…
PriorityP337high7.1CVSS 3.1
AVNACLPRNUIRSCCLILAL
EPSS
0.95%
57.3th percentile
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome_chrome | — | — | |
| redhat | keycloak | < 22.0.7 | 22.0.7 |
| redhat | migration_toolkit_for_applications | — | — |
| redhat | migration_toolkit_for_applications | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform_for_ibm_z | — | — |
| redhat | openshift_container_platform_for_ibm_z | — | — |
| redhat | openshift_container_platform_for_linuxone | — | — |
| redhat | openshift_container_platform_for_linuxone | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | single_sign-on | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2024-6290
vendor_chrome·2024-06-24·CVSS 8.8
CVE-2024-6290 [HIGH] Stable Channel Update for Desktop: CVE-2024-6290
Stable Channel Update for Desktop
CVE-2024-6290: Use after free in Dawn. Reported by wgslfuzz on 2024-05-23 [$4000][ 40942995 ] High CVE-2024-6291: Use after free in Swiftshader
Reported by Cassidy Kim(@cassidy6564) on 2023-11-15 [TBD][ 342545100 ] High CVE-2024-6292: Use after free in Dawn
Severity: high
Red Hat
keycloak: path traversal in the redirect validation
vendor_redhat·2024-04-16·CVSS 7.1
CVE-2024-2419 [HIGH] CWE-601 keycloak: path traversal in the redirect validation
keycloak: path traversal in the redirect validation
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.
Statement: Note that this affects only Keycloak and Red Hat build of Keycloak, which uses Quarkus in under layers. Red Hat Single Sign-On is not affected sin
Red Hat
keycloak: redirect_uri validation bypass
vendor_redhat·2023-12-14·CVSS 7.1
CVE-2023-6291 [HIGH] CWE-601 keycloak: redirect_uri validation bypass
keycloak: redirect_uri validation bypass
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base o
OSV
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
osv·2023-12-21
CVE-2023-6291 [HIGH] The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "[www%2ekeycloak%2eorg%2fapp%2f:[email protected]](https://www%2ekeycloak%2eorg%2fapp%2f:[email protected]/)" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.
### Acknowledgements
Ka
GHSA
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
ghsa·2023-12-21
CVE-2023-6291 [HIGH] CWE-20 The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "[www%2ekeycloak%2eorg%2fapp%2f:[email protected]](https://www%2ekeycloak%2eorg%2fapp%2f:[email protected]/)" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.
### Acknowledgements
Ka
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-6291 keycloak: redirect_uri validation bypass
bugzilla·2023-11-24·CVSS 7.1
CVE-2023-6291 [HIGH] CVE-2023-6291 keycloak: redirect_uri validation bypass
CVE-2023-6291 keycloak: redirect_uri validation bypass
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "https://www%2ekeycloak%2eorg%2fapp%2f:[email protected]" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.
Refer: https://github.com/keycloak/keycloak/pull/24819
Discussion:
This issue has been addressed in the following products:
Red
arXiv
Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution
arxiv_fulltext·2026-03
Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution
## Introduction
Consider the following scenario. A user’s personal AI agent periodically checks email in the background while the user is away (e.g., to add important schedules to the calendar).
Among the incoming messages is one that appears to come from a colleague and recommends using a particular software version for an upcoming deployment.
The user never reads this email.
Several days later, the user asks the agent to deploy that software, and the agent chooses that particular version because it has already internalized the recommendation into memory.
No prompt injection occurred, no malicious code was executed, and no explicit tool use was involved.
The agent simply absorbed externally encountered information during routine background operation, and that information later shaped its
https://access.redhat.com/errata/RHSA-2023:7854https://access.redhat.com/errata/RHSA-2023:7855https://access.redhat.com/errata/RHSA-2023:7856https://access.redhat.com/errata/RHSA-2023:7857https://access.redhat.com/errata/RHSA-2023:7858https://access.redhat.com/errata/RHSA-2023:7860https://access.redhat.com/errata/RHSA-2023:7861https://access.redhat.com/errata/RHSA-2024:0798https://access.redhat.com/errata/RHSA-2024:0799https://access.redhat.com/errata/RHSA-2024:0800https://access.redhat.com/errata/RHSA-2024:0801https://access.redhat.com/errata/RHSA-2024:0804https://access.redhat.com/security/cve/CVE-2023-6291https://bugzilla.redhat.com/show_bug.cgi?id=2251407https://access.redhat.com/errata/RHSA-2023:7854https://access.redhat.com/errata/RHSA-2023:7855https://access.redhat.com/errata/RHSA-2023:7856https://access.redhat.com/errata/RHSA-2023:7857https://access.redhat.com/errata/RHSA-2023:7858https://access.redhat.com/errata/RHSA-2023:7860https://access.redhat.com/errata/RHSA-2023:7861https://access.redhat.com/errata/RHSA-2024:0798https://access.redhat.com/errata/RHSA-2024:0799https://access.redhat.com/errata/RHSA-2024:0800https://access.redhat.com/errata/RHSA-2024:0801https://access.redhat.com/errata/RHSA-2024:0804https://access.redhat.com/security/cve/CVE-2023-6291https://bugzilla.redhat.com/show_bug.cgi?id=2251407
2024-01-26
Published