CVE-2024-8883 Keycloak: vulnerable redirect uri validation results in open redirec
Attackers can redirect users to malicious URLs if specific localhost redirect URIs are configured, exposing authorization codes and enabling session hijacking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-8883?
CVE-2024-8883 is a medium-severity vulnerability in Redhat Build of Keycloak, published on 19 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Weakness: CWE-601
Which versions are affected by CVE-2024-8883?
6 open source packages ship an affected version, including org.keycloak:keycloak-services. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions | 22.0.13 |
org.keycloak:keycloak-services Maven | All versions | 22.0.13 |
org.keycloak:keycloak-services Maven | From 23.0.0 | 24.0.8 |
org.keycloak:keycloak-services Maven | From 23.0.0 | 24.0.8 |
org.keycloak:keycloak-services Maven | From 25.0.0 | 25.0.6 |
org.keycloak:keycloak-services Maven | From 25.0.0 | 25.0.6 |
Linux distribution packages (14)
eap8-eap-product-conf-parent Red Hat:jboss_enterprise_application_platform:8.0::el8 | All versions | 0:800.4.1-1.GA_redhat_00001.1.el8eap |
eap8-eap-product-conf-wildfly-ee-feature-pack Red Hat:jboss_enterprise_application_platform:8.0::el8 | All versions | 0:800.4.1-1.GA_redhat_00001.1.el8eap |
eap8-wildfly Red Hat:jboss_enterprise_application_platform:8.0::el8 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
eap8-wildfly-java-jdk11 Red Hat:jboss_enterprise_application_platform:8.0::el8 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
eap8-wildfly-java-jdk17 Red Hat:jboss_enterprise_application_platform:8.0::el8 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
eap8-wildfly-java-jdk21 Red Hat:jboss_enterprise_application_platform:8.0::el8 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
eap8-wildfly-modules Red Hat:jboss_enterprise_application_platform:8.0::el8 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el8eap |
eap8-eap-product-conf-parent Red Hat:jboss_enterprise_application_platform:8.0::el9 | All versions | 0:800.4.1-1.GA_redhat_00001.1.el9eap |
eap8-eap-product-conf-wildfly-ee-feature-pack Red Hat:jboss_enterprise_application_platform:8.0::el9 | All versions | 0:800.4.1-1.GA_redhat_00001.1.el9eap |
eap8-wildfly Red Hat:jboss_enterprise_application_platform:8.0::el9 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
eap8-wildfly-java-jdk11 Red Hat:jboss_enterprise_application_platform:8.0::el9 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
eap8-wildfly-java-jdk17 Red Hat:jboss_enterprise_application_platform:8.0::el9 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
eap8-wildfly-java-jdk21 Red Hat:jboss_enterprise_application_platform:8.0::el9 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
eap8-wildfly-modules Red Hat:jboss_enterprise_application_platform:8.0::el9 | All versions | 0:8.0.4-3.GA_redhat_00007.1.el9eap |
Products include Redhat Build of Keycloak, Redhat Openshift Container Platform, Redhat Openshift Container Platform for Ibm Z, Redhat Openshift Container Platform for Linuxone, Redhat Openshift Container Platform for Power, Redhat Single Sign-On.
How do I fix CVE-2024-8883?
Upgrade org.keycloak:keycloak-services to a fixed version for your release line: 22.0.13, 24.0.8 or 25.0.6.
Is CVE-2024-8883 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8883 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Redhat Build of Keycloak
- CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- CVE-2026-3047 Keycloak SAML Broken has Authentication Bypass by Primary Weakness
- CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
- CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
Sources
Also known as GHSA-w8gr-xwp4-r9f7, RHSA-2024:10386.