You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Keycloak path transversal vulnerability in redirection validation
High severity
GitHub Reviewed
Published
Apr 17, 2024
in
keycloak/keycloak
•
Updated Apr 27, 2024
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.
Acknowledgements:
Special thanks to Axel Flamcourt for reporting this issue and helping us improve our project.
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.
Acknowledgements:
Special thanks to Axel Flamcourt for reporting this issue and helping us improve our project.
References