Description
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak-services | < 22.0.12, 23.0.0 – < 24.0.7, 25.0.0 – < 25.0.5 | 22.0.12 |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat build of Keycloak 22 | — | — |
| Red Hat | Red Hat build of Keycloak 24 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.18-1.redhat_00001.1.el7sso | RHSA-2024:6880, RHSA-2024:6879, RHSA-2024:6878 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.33.0-1.redhat_00015.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-aesh-extensions | 1.8.0-2.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-aesh-readline | 2.2.0-2.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-codec | 1.16.1-2.redhat_00007.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-collections | 3.2.2-28.redhat_2.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-io | 2.15.1-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-commons-lang | 3.14.0-2.redhat_00006.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.0.5-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-artemis-native +2 | 1:2.0.0-2.redhat_00005.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-artemis-wildfly-integration | 2.0.1-1.redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-asyncutil | 0.1.0-2.redhat_00010.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-aws-java-sdk +4 | 1.12.284-2.redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-cryptacular | 1.2.5-2.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.4.0-1.GA_redhat_00001.1.el8eap | RHSA-2024:10386, RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-fastinfoset | 2.1.0-4.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.2.31-1.Final_redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-hibernate-validator +1 | 8.0.1-3.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-hppc | 0.8.1-2.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jakarta-servlet-jsp-jstl +1 | 3.0.1-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jboss-cert-helper +1 | 1.1.3-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.5.3-1.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jctools +1 | 4.0.2-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-jgroups | 5.3.10-1.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-log4j | 2.22.1-1.redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-narayana +8 | 6.0.3-1.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-nimbus-jose-jwt | 9.37.3-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-objectweb-asm +1 | 9.6.0-1.redhat_00002.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-pem-keystore | 2.3.0-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-resteasy-extensions +1 | 2.0.1-3.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-resteasy-spring | 3.0.1-2.Final_redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-saaj-impl | 3.0.4-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-shibboleth-java-support | 8.0.0-6.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.16-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-snakeyaml | 2.2.0-1.redhat_00001.1.el8eap | RHSA-2024:8824, RHSA-2024:8823 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.4-2.GA_redhat_00005.1.el8eap | RHSA-2024:10386, RHSA-2024:8824, RHSA-2024:8823 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Keycloak - Open Redirect http/cves/2024/CVE-2024-8883.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | < 22.0.13 | 22.0.13 | GHSA-w8gr-xwp4-r9f7 |
| Maven | org.keycloak:keycloak-services | >= 23.0.0, < 24.0.8 | 24.0.8 | GHSA-w8gr-xwp4-r9f7 |
| Maven | org.keycloak:keycloak-services | >= 25.0.0, < 25.0.6 | 25.0.6 | GHSA-w8gr-xwp4-r9f7 |
Advisories 8
- RHSA-2024:8824 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:8823 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:6880 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:6878 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:6879 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:10386 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0 update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2024-2190 Red Hat Single Sign On und Keycloak: Mehrere Schwachstellen ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · May 14, 2025
- WID-SEC-2024-2185 Keycloak: Schwachstelle ermöglicht Darstellen falscher Informationen BSI CERT-Bund (WID) · May 14, 2025
References
- RHSA-2024:10385 vendor-advisory
- RHSA-2024:10386 vendor-advisory
- RHSA-2024:6878 vendor-advisory
- RHSA-2024:6879 vendor-advisory
- RHSA-2024:6880 vendor-advisory
- RHSA-2024:6882 vendor-advisory
- RHSA-2024:6886 vendor-advisory
- RHSA-2024:6887 vendor-advisory
- RHSA-2024:6888 vendor-advisory
- RHSA-2024:6889 vendor-advisory
- RHSA-2024:6890 vendor-advisory
- RHSA-2024:8823 vendor-advisory
- RHSA-2024:8824 vendor-advisory
- RHSA-2024:8826 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-8883 vdb-entry
- RHBZ#2312511 issue-tracking
- https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java