Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2022-3782 EUVD-2022-7628GHSA-g8q8-fggx-9r3q

Keycloak vulnerable to path traversal via double URL encoding

Published Jan 11, 2023 · Updated Apr 9, 2025 · Assigned by redhat

Vendor: redhat.com Product: Keycloak Package: org.keycloak:keycloak-parent Ecosystem: Maven

Description

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.

Affected products

VendorProductAffectedFixed
redhat.com Keycloak 20.0.2 – < 20.0.2 20.0.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Single Sign On 7 rh-sso7-keycloak +1 18.0.3-1.redhat_00002.1.el7sso RHSA-2022:8963, RHSA-2022:8962, RHSA-2022:8961

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.keycloak:keycloak-parent < 20.0.2 20.0.2 GHSA-g8q8-fggx-9r3q

Advisories 5

References