Sign in
Deutsch English Español Polski
High

The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted

  • Disclosed: 21.12.2023
  • Updated: 11.10.2026 11:22

An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.

The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "www%2ekeycloak%2eorg%2fapp%2f:y@example.com" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.

Acknowledgements

Karel Knibbe

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.keycloak:keycloak-services < 23.0.3 23.0.3

References

CVSS score 7.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness (CWE)
CWE-20
Platform
Java / Kotlin (Maven)
Package
org.keycloak:keycloak-services
Disclosed
21.12.2023
Updated
11.10.2026 11:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mpwq-j3xf-7m5w - CC BY 4.0

Vulnerability history: org.keycloak:keycloak-services

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (98) in the archive
Total entries
98
First → latest
01.2022 08.2026
Without a fix
16
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 26
  • Medium 51
  • Low 18

Disclosures per year

Severity:
  1. The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted this entry
    High · 7.1 CVE-2023-6291 < 23.0.3 23.0.3
  2. Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
    Critical · 9.1 CVE-2026-18963 >= 26.0.0, < 26.4.15, >= 26.5.0, < 26.6.6, >= 26.7.0, < 26.7.2 26.4.15, 26.6.6, 26.7.2
  3. Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
    High · 7.7 CVE-2026-2092 <= 26.2.5, >= 26.3.0, <= 26.4.7, >= 26.5.0 no fix
  4. Keycloak has privilege escalation via improper scope mapping enforcement
    High · 7.3 CVE-2026-9795 < 26.6.4 26.6.4
  5. Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
    High · 8.1 CVE-2026-7504 < 26.6.2 26.6.2
  6. Keycloak: Session fixation in OIDC login flow that can lead to account takeover
    High · 7.5 CVE-2026-7507 < 26.6.2 26.6.2
  7. Keycloak: Access token disclosure and implicit flow bypass via forged client data
    High · 7.1 CVE-2026-7571 < 26.6.2 26.6.2
  8. Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
    High · 7.4 CVE-2026-4282 < 26.5.7 26.5.7
  9. Keycloak: Application-Level DoS via Scope Processing
    High · 7.5 CVE-2026-4634 < 26.5.7 26.5.7
  10. Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
    High · 8.1 CVE-2026-4636 < 26.5.7 26.5.7
  11. Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
    High · 7.3 CVE-2026-3872 < 26.5.7 26.5.7
  12. Keycloak: Unauthorized authentication via disabled SAML Identity Provider
    High · 8.1 CVE-2026-2603 < 26.5.5 26.5.5
  13. Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
    High · 8.1 CVE-2026-3009 < 26.5.5 26.5.5
  14. Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
    High · 8.8 CVE-2026-1486 >= 26.5.0, < 26.5.3, < 26.4.9 26.5.3, 26.4.9
  15. Keycloak affected by improper invitation token validation
    High · 8.1 CVE-2026-1529 >= 26.5.0, < 26.5.3, < 26.2.13, >= 26.3.0, < 26.4.9 26.5.3, 26.2.13, 26.4.9
  16. Keycloak hostname verification
    High · 8.2 CVE-2025-3501 < 26.2.2 26.2.2
  17. org.keycloak:keycloak-services has Inefficient Regular Expression Complexity
    High · 6.5 CVE-2024-10270 < 24.0.9, >= 25.0.0, < 26.0.6 24.0.9, 26.0.6
  18. Keycloak has session fixation in Elytron SAML adapters
    High · 7.1 CVE-2024-7341 < 22.0.12, >= 23.0.0, < 24.0.7, >= 25.0.0, < 25.0.5 22.0.12, 24.0.7, 25.0.5
  19. Keycloak's admin API allows low privilege users to use administrative functions
    High · 8.1 CVE-2024-3656 < 24.0.5 24.0.5
  20. Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
    High · 7.5 CVE-2024-4540 < 24.0.5 24.0.5
  21. Keycloak path traversal vulnerability in redirection validation
    High · 8.1 CVE-2024-1132 < 22.0.10, >= 23.0.0, < 24.0.3 22.0.10, 24.0.3
Show more (8) Showing 21 of 29

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.