CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2024-8883
Medium (6.1) in redhat. EPSS 2.1% chance of exploitation in the next 30 days. Fixed in org.keycloak:keycloak-services 22.0.13, 24.0.8, 25.0.6.
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:build_of_keycloak
- redhat:openshift_container_platform
- redhat:openshift_container_platform_for_ibm_z
- redhat:openshift_container_platform_for_linuxone
- redhat:openshift_container_platform_for_power
- redhat:single_sign-on
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w8gr-xwp4-r9f7 | Maven | org.keycloak:keycloak-services | <22.0.13 | 22.0.13 |
| GHSA-w8gr-xwp4-r9f7 | Maven | org.keycloak:keycloak-services | >=23.0.0 <24.0.8 | 24.0.8 |
| GHSA-w8gr-xwp4-r9f7 | Maven | org.keycloak:keycloak-services | >=25.0.0 <25.0.6 | 25.0.6 |