Skip to content
Sign in
6.1 Medium

CVE-2024-8883 A misconfiguration flaw was found in Keycloak

Description

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

Affected products and versions

Product Affected versions Fixed in
Red Hat Build of Keycloak Versions not published
Red Hat build of Keycloak 22 22 earliest → < 22-21 22-21
Red Hat build of Keycloak 24 24 earliest → < 24-17 24-17
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 8 Versions not published
Show the 3 other branches
Product Affected versions Fixed in
Red Hat Single Sign-On 7.6 for RHEL 9 Versions not published
RHEL-8 based Middleware Containers 7.6 earliest → < 7.6-54 7.6-54
Red Hat Single Sign-On 7.0 Versions not published

Other CVEs of Red Hat Build of Keycloak

The 277 CVEs of Red Hat Build of Keycloak →
CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 9.1 Critical CVE-2026-9797 Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator 6.5 Medium CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Medium CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Medium
Track this CVE