CVE-2024-8883
published 2024-09-19CVE-2024-8883: A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to…
PriorityP278medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.96%
78.1th percentile
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform_for_ibm_z | — | — |
| redhat | openshift_container_platform_for_ibm_z | — | — |
| redhat | openshift_container_platform_for_linuxone | — | — |
| redhat | openshift_container_platform_for_linuxone | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | single_sign-on | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/realms/master/protocol/openid-connect/auth?client_id={{client_id}}&redirect_uri={{redir_host}}:80@{{redirect_uri}}↗
- →Look for HTTP 302 responses from Keycloak's OpenID Connect auth endpoint where the Location header contains a userinfo-style redirect (host:port@external-domain), indicating open redirect exploitation via localhost/127.0.0.1 bypass. ↗
- →Monitor Keycloak auth requests where redirect_uri contains the pattern <localhost_or_127.0.0.1>:PORT@<external-host>, which abuses URL userinfo parsing to bypass redirect URI validation. ↗
- →Shodan query 'title:"keycloak"' can be used to identify exposed Keycloak instances potentially vulnerable to this open redirect. ↗
- →The attack uses a clusterbomb payload across multiple client_id values (security-admin-console, master-realm, broker, admin-cli, account, account-console) and multiple localhost variants including IPv6 [::]. ↗
- ·Vulnerability is only exploitable when a Keycloak client has 'Valid Redirect URI' configured as http://localhost or http://127.0.0.1 — misconfiguration is a prerequisite. ↗
- ·The IPv6 loopback variant http://[::] is also a valid trigger condition for this bypass, in addition to IPv4 localhost addresses. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vulncheck6.1MEDIUM
vendor_redhat6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
ghsa·2024-10-14
CVE-2024-8883 [MEDIUM] CWE-601 Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
OSV
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
osv·2024-10-14
CVE-2024-8883 [MEDIUM] Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
VulnCheck
Red Hat build_of_keycloak URL Redirection to Untrusted Site ('Open Redirect')
vulncheck·2024·CVSS 6.1
CVE-2024-8883 [MEDIUM] Red Hat build_of_keycloak URL Redirection to Untrusted Site ('Open Redirect')
Red Hat build_of_keycloak URL Redirection to Untrusted Site ('Open Redirect')
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Affected: Red Hat build_of_keycloak
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://aws.amazon.com/blogs/security/real-time-malware-defense-leveraging-aws-network-firewall-active-threat-defense/; https://www.labs.greynoise.io/grimoire/2026-01-24-weekly-
Red Hat
Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
vendor_redhat·2024-09-19·CVSS 6.1
CVE-2024-8883 [MEDIUM] CWE-601 Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Mitigation: Mitigation for this issue is either not available or the currently a
No detection rules found.
Nuclei
Keycloak - Open Redirect
nuclei·CVSS 6.1
CVE-2024-8883 [MEDIUM] Keycloak - Open Redirect
Keycloak - Open Redirect
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Template:
id: CVE-2024-8883
info:
name: Keycloak - Open Redirect
author: iamnoooob,rootxharsh,pdresearch
severity: medium
description: |
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to sessi
Greynoiseio
NoiseLetter October 2025
blogs_greynoiseio
NoiseLetter October 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2024-8883 Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
bugzilla·2024-09-16·CVSS 6.1
CVE-2024-8883 [MEDIUM] CVE-2024-8883 Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
CVE-2024-8883 Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
It is possible to configure Keycloak in such a manner that any application with a 'Valid Redirect URI' set to http://localhost or http://127.0.0.1 can be redirected to an arbitrary URL of the attackers choosing. In the process sensitive information such as the authorization code can be exposed to the attacker, resulting in possible session hijacking.
Discussion:
This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6 for RHEL 7
Via RHSA-2024:6878 https://access.redhat.com/errata/RHSA-2024:6878
---
This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6 for RHEL 8
Via RHSA-2024:6879 https://access.redhat.com/errata/RHSA-2024:6879
---
This issu
https://access.redhat.com/errata/RHSA-2024:10385https://access.redhat.com/errata/RHSA-2024:10386https://access.redhat.com/errata/RHSA-2024:6878https://access.redhat.com/errata/RHSA-2024:6879https://access.redhat.com/errata/RHSA-2024:6880https://access.redhat.com/errata/RHSA-2024:6882https://access.redhat.com/errata/RHSA-2024:6886https://access.redhat.com/errata/RHSA-2024:6887https://access.redhat.com/errata/RHSA-2024:6888https://access.redhat.com/errata/RHSA-2024:6889https://access.redhat.com/errata/RHSA-2024:6890https://access.redhat.com/errata/RHSA-2024:8823https://access.redhat.com/errata/RHSA-2024:8824https://access.redhat.com/errata/RHSA-2024:8826https://access.redhat.com/security/cve/CVE-2024-8883https://bugzilla.redhat.com/show_bug.cgi?id=2312511https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
2024-09-19
Published
Exploited in the wild