--- id: CVE-2024-8883 title: A misconfiguration flaw was found in Keycloak summary: >- A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as author… severity: medium cvss: 6.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N' cwe: - CWE-601 vendor: redhat product: build_of_keycloak affected: - build_of_keycloak - openshift_container_platform = 4.11 - openshift_container_platform = 4.12 - openshift_container_platform_for_ibm_z = 4.9 - openshift_container_platform_for_ibm_z = 4.10 - openshift_container_platform_for_linuxone = 4.9 - openshift_container_platform_for_linuxone = 4.10 - openshift_container_platform_for_power = 4.9 - openshift_container_platform_for_power = 4.10 - single_sign-on - single_sign-on = 7.6 published: '2024-09-19' updated: '2026-08-04' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8883' references: - url: 'https://access.redhat.com/errata/RHSA-2024:10385' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:10386' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6878' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6879' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6880' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6882' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6886' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6887' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6888' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6889' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:6890' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:8823' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:8824' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:8826' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2024-8883' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2312511' label: secalert@redhat.com - url: >- https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java label: secalert@redhat.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-8883.json - url: 'https://www.cve.org/CVERecord?id=CVE-2024-8883' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8883' tags: - nvd - exploit-available - csaf - vex - red-hat epss: 0.02112 epssPercentile: 0.81707 ingestedAt: '2026-08-04T07:37:59.876Z' exploits: nuclei: - CVE-2024-8883 checkedAt: '2026-10-27T16:42:47.502Z' exploitAvailable: true patched: - single_sign_on_7_6_for_rhel_7_server - jboss_eap_8_0_for_rhel 8 - middleware_containers_for_openshift - single_sign_on_7_6_for_rhel 8 - jboss_eap_8_0_for_rhel 9 - build_of_keycloak 22 - build_of_keycloak 24 - single_sign_on_7_6_for_rhel 9 - build_of_keycloak - jboss_enterprise_application_platform 8 - single_sign_on 7 --- ## Overview A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking. ## Affected - `build_of_keycloak` - `openshift_container_platform = 4.11` - `openshift_container_platform = 4.12` - `openshift_container_platform_for_ibm_z = 4.9` - `openshift_container_platform_for_ibm_z = 4.10` - `openshift_container_platform_for_linuxone = 4.9` - `openshift_container_platform_for_linuxone = 4.10` - `openshift_container_platform_for_power = 4.9` - `openshift_container_platform_for_power = 4.10` - `single_sign-on` - `single_sign-on = 7.6` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2024:6878** · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 7 Server · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6878) - **RHSA-2024:8823** · Red Hat · fixed in: Red Hat JBoss EAP 8.0 for RHEL 8 · released 2024-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2024:8823) - **RHSA-2024:10386** · Red Hat · fixed in: Red Hat JBoss EAP 8.0 for RHEL 8, Red Hat JBoss EAP 8.0 for RHEL 9 · released 2024-11-26 · [advisory](https://access.redhat.com/errata/RHSA-2024:10386) - **RHSA-2024:6882** · Red Hat · fixed in: Middleware Containers for OpenShift · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6882) - **RHSA-2024:6879** · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 8 · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6879) - **RHSA-2024:8824** · Red Hat · fixed in: Red Hat JBoss EAP 8.0 for RHEL 9 · released 2024-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2024:8824) - **RHSA-2024:6887** · Red Hat · fixed in: Red Hat build of Keycloak 22 · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6887) - **RHSA-2024:6889** · Red Hat · fixed in: Red Hat build of Keycloak 24 · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6889) - **RHSA-2024:6880** · Red Hat · fixed in: Red Hat Single Sign-On 7.6 for RHEL 9 · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6880) - **RHSA-2024:6890** · Red Hat · fixed in: Red Hat Build of Keycloak · released 2024-09-19 · [advisory](https://access.redhat.com/errata/RHSA-2024:6890) - **RHSA-2024:8826** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8 · released 2024-11-04 · [advisory](https://access.redhat.com/errata/RHSA-2024:8826)