In short
- CVE-2024-2419 is a HIGH (CVSS 7.1) vulnerability affecting org.keycloak:keycloak-services.
- Chance of exploitation in the next 30 days (EPSS): 0.50%, higher than 42.8% of all vulnerabilities.
- Fix: update to 24.0.3, 22.0.10 or later.
Description
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
NVD description
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.
More vulnerabilities in org.keycloak:keycloak-services
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free