Description
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | keycloak | 3.2.1.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 3.4.14-1.Final_redhat_00001.1.jbcs.el6 | RHSA-2018:3593, RHSA-2018:3592 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-core | <= 3.2.1.Final | — | GHSA-3qh2-mccc-q5m6 |
Advisories 2
- RHSA-2018:3592 Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 6 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:3593 Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 7 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658
- RHSA-2018:3592 vendor-advisory
- RHSA-2018:3593 vendor-advisory
- RHSA-2018:3595 vendor-advisory