| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | < 23.0.3 | 23.0.3 |
| keycloak | < 22.0.7 | 22.0.7 |
| migration toolkit for applications | = 6.0= 7.0 | |
| openshift container platform | = 4.11= 4.12 | |
| openshift container platform for ibm z | = 4.10= 4.9 | |
| openshift container platform for linuxone | = 4.10= 4.9 | |
| openshift container platform for power | = 4.10= 4.9 | |
| single sign-on | = 7.6 |
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "www%2ekeycloak%2eorg%2fapp%2f:[email protected]" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.
Karel Knibbe
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free