{"id":"CVE-2024-8883","title":"A misconfiguration flaw was found in Keycloak","summary":"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as author…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-601"],"vendor":"redhat","product":"build_of_keycloak","affected":["build_of_keycloak","openshift_container_platform = 4.11","openshift_container_platform = 4.12","openshift_container_platform_for_ibm_z = 4.9","openshift_container_platform_for_ibm_z = 4.10","openshift_container_platform_for_linuxone = 4.9","openshift_container_platform_for_linuxone = 4.10","openshift_container_platform_for_power = 4.9","openshift_container_platform_for_power = 4.10","single_sign-on","single_sign-on = 7.6"],"published":"2024-09-19","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-8883","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:10385","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:10386","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6878","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6879","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6880","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6882","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6886","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6887","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6888","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6889","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6890","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8823","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8824","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8826","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2024-8883","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2312511","label":"secalert@redhat.com"},{"url":"https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-8883.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8883"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8883"}],"tags":["nvd","exploit-available","csaf","vex","red-hat"],"epss":0.02112,"epssPercentile":0.81707,"ingestedAt":"2026-08-04T07:37:59.876Z","exploits":{"nuclei":["CVE-2024-8883"],"checkedAt":"2026-10-27T16:42:47.502Z"},"exploitAvailable":true,"patched":["single_sign_on_7_6_for_rhel_7_server","jboss_eap_8_0_for_rhel 8","middleware_containers_for_openshift","single_sign_on_7_6_for_rhel 8","jboss_eap_8_0_for_rhel 9","build_of_keycloak 22","build_of_keycloak 24","single_sign_on_7_6_for_rhel 9","build_of_keycloak","jboss_enterprise_application_platform 8","single_sign_on 7"],"slug":"CVE-2024-8883","body":"## Overview\n\nA misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.\n\n## Affected\n\n- `build_of_keycloak`\n- `openshift_container_platform = 4.11`\n- `openshift_container_platform = 4.12`\n- `openshift_container_platform_for_ibm_z = 4.9`\n- `openshift_container_platform_for_ibm_z = 4.10`\n- `openshift_container_platform_for_linuxone = 4.9`\n- `openshift_container_platform_for_linuxone = 4.10`\n- `openshift_container_platform_for_power = 4.9`\n- `openshift_container_platform_for_power = 4.10`\n- `single_sign-on`\n- `single_sign-on = 7.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2024:6878** · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 7 Server · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6878)\n- **RHSA-2024:8823** · Red Hat · fixed in: Red Hat JBoss EAP 8.0 for RHEL 8 · released 2024-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2024:8823)\n- **RHSA-2024:10386** · Red Hat · fixed in: Red Hat JBoss EAP 8.0 for RHEL 8, Red Hat JBoss EAP 8.0 for RHEL 9 · released 2024-11-26 · [advisory](https://access.redhat.com/errata/RHSA-2024:10386)\n- **RHSA-2024:6882** · Red Hat · fixed in: Middleware Containers for OpenShift · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6882)\n- **RHSA-2024:6879** · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 8 · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6879)\n- **RHSA-2024:8824** · Red Hat · fixed in: Red Hat JBoss EAP 8.0 for RHEL 9 · released 2024-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2024:8824)\n- **RHSA-2024:6887** · Red Hat · fixed in: Red Hat build of Keycloak 22 · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6887)\n- **RHSA-2024:6889** · Red Hat · fixed in: Red Hat build of Keycloak 24 · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6889)\n- **RHSA-2024:6880** · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 9 · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6880)\n- **RHSA-2024:6890** · Red Hat · fixed in: Red Hat Build of Keycloak · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6890)\n- **RHSA-2024:8826** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8 · released 2024-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2024:8826)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":4753,"id":"CVE-2024-8883","ts":1788887203657,"field":"exploit_available","old":"false","new":"true"},{"seq":3636,"id":"CVE-2024-8883","ts":1788886319840,"field":"exploit_available","old":"true","new":"false"},{"seq":2487,"id":"CVE-2024-8883","ts":1788882988351,"field":"exploit_available","old":"false","new":"true"},{"seq":1516,"id":"CVE-2024-8883","ts":1788882401947,"field":"exploit_available","old":"true","new":"false"},{"seq":630,"id":"CVE-2024-8883","ts":1788881839686,"field":"exploit_available","old":"false","new":"true"}]}