High · published January 26, 2024
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
| Product | Versions | Fixed in |
|---|---|---|
| redhat/keycloak | < 22.0.7 | 22.0.7 |
| redhat/single_sign-on | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform_for_ibm_z | all versions | — |
| redhat/openshift_container_platform_for_ibm_z | all versions | — |
| redhat/openshift_container_platform_for_linuxone | all versions | — |
| redhat/openshift_container_platform_for_linuxone | all versions | — |
| redhat/openshift_container_platform_for_power | all versions | — |
| redhat/openshift_container_platform_for_power | all versions | — |
| redhat/single_sign-on | all versions | — |
| redhat/migration_toolkit_for_applications | all versions | — |
| redhat/migration_toolkit_for_applications | all versions | — |