Kurz gesagt
- CVE-2024-2419 ist eine Schwachstelle (HOCH (CVSS 7.1)) in org.keycloak:keycloak-services.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.50%, höher als bei 42.8% aller Schwachstellen.
- Abhilfe: auf 24.0.3, 22.0.10 oder neuer aktualisieren.
Description
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
NVD description
A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free