| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | ≥ 23.0.0, < 24.0.8≥ 25.0.0, < 25.0.6< 22.0.13 | 24.0.825.0.622.0.13 |
| openshift container platform | = 4.11= 4.12 | |
| openshift container platform for ibm z | = 4.10= 4.9 | |
| openshift container platform for linuxone | = 4.10= 4.9 | |
| openshift container platform for power | = 4.10= 4.9 | |
| single sign-on | = 7.6 |
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free