CVE-2024-1132

Keycloak: path transversal in redirection validation

HIGH 8.1

At a glance

Source: NVD
EPSS: EPSS 1.55 % · percentile 75 (2026-10-28)
State: PUBLISHED
Published: 2024-04-17 13:21 UTC
Updated: 2026-08-04 17:41 UTC
Assigner: redhat
NVD status: Analyzed

Description

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

Weaknesses (CWE)

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	redhat
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	NVD · secalert@redhat.com (Secondary)

Advisories

GHSA-72vp-xfrc-42xm — Keycloak path traversal vulnerability in redirection validation

European references

ENISA EUVD · EUVD-2024-1134
GCVE · GCVE-0-2024-1132

Affected configurations (NVD CPE)

cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* ≥ 21.1.0 < 22.0.10
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* ≥ 23.0.0 < 24.0.3
cpe:2.3:a:redhat:migration_toolkit_for_applications:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_runtimes:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*

Affected products

Product	Versions
keycloak	affected 21.1.0 < 22.0.10 ; affected 23.0.0 < 24.0.3
Red Hat · Migration Toolkit for Runtimes 1 on RHEL 8	unaffected 1.2-23 < *
Red Hat · Migration Toolkit for Runtimes 1 on RHEL 8	unaffected 1.2-15 < *
Red Hat · Migration Toolkit for Runtimes 1 on RHEL 8	unaffected 1.2-16 < *
Red Hat · Migration Toolkit for Runtimes 1 on RHEL 8	unaffected 1.2-14 < *
Red Hat · MTA-6.2-RHEL-9	unaffected 6.2.3-2 < *
Red Hat · Red Hat AMQ Broker 7
Red Hat · Red Hat AMQ Broker 7
Red Hat · Red Hat AMQ Broker 7
Red Hat · Red Hat build of Keycloak 22	unaffected 22.0.10-1 < *
Red Hat · Red Hat build of Keycloak 22	unaffected 22-13 < *
Red Hat · Red Hat build of Keycloak 22	unaffected 22-16 < *
Red Hat · Red Hat build of Keycloak 22.0.10
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7	unaffected 0:18.0.13-1.redhat_00001.1.el7sso < *
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8	unaffected 0:18.0.13-1.redhat_00001.1.el8sso < *
Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9	unaffected 0:18.0.13-1.redhat_00001.1.el9sso < *
Red Hat · RHEL-8 based Middleware Containers	unaffected 7.6-46 < *
Red Hat · RHSSO 7.6.8
Red Hat · Red Hat build of Apicurio Registry 2
Red Hat · Red Hat build of Quarkus

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD