High · published April 17, 2024
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
| Product | Versions | Fixed in |
|---|---|---|
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform_for_ibm_z | all versions | — |
| redhat/openshift_container_platform_for_ibm_z | all versions | — |
| redhat/openshift_container_platform_for_linuxone | all versions | — |
| redhat/openshift_container_platform_for_linuxone | all versions | — |
| redhat/openshift_container_platform_for_power | all versions | — |
| redhat/openshift_container_platform_for_power | all versions | — |
| redhat/single_sign-on | all versions | — |
| redhat/single_sign-on | all versions | — |
| redhat/build_of_keycloak | all versions | — |
| redhat/jboss_middleware_text-only_advisories | all versions | — |
| redhat/keycloak | ≥ 21.1.0, < 22.0.10 | 22.0.10 |
| redhat/keycloak | ≥ 23.0.0, < 24.0.3 | 24.0.3 |
| redhat/migration_toolkit_for_applications | all versions | — |
| redhat/migration_toolkit_for_runtimes | all versions | — |