Sign in
Deutsch English Español Polski
High

Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak

  • Disclosed: 19.05.2026
  • Updated: 11.10.2026 12:22

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.

The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.keycloak:keycloak-services < 26.6.2 26.6.2

References

CVSS score 8.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness (CWE)
CWE-601
Platform
Java / Kotlin (Maven)
Package
org.keycloak:keycloak-services
Disclosed
19.05.2026
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-rp95-xpg9-c2cq - CC BY 4.0

Vulnerability history: org.keycloak:keycloak-services

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (98) in the archive
Total entries
98
First → latest
01.2022 08.2026
Without a fix
16
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 26
  • Medium 51
  • Low 18

Disclosures per year

Severity:
  1. Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
    Critical · 9.1 CVE-2026-18963 >= 26.0.0, < 26.4.15, >= 26.5.0, < 26.6.6, >= 26.7.0, < 26.7.2 26.4.15, 26.6.6, 26.7.2
  2. Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
    High · 7.7 CVE-2026-2092 <= 26.2.5, >= 26.3.0, <= 26.4.7, >= 26.5.0 no fix
  3. Keycloak has privilege escalation via improper scope mapping enforcement
    High · 7.3 CVE-2026-9795 < 26.6.4 26.6.4
  4. Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak this entry
    High · 8.1 CVE-2026-7504 < 26.6.2 26.6.2
  5. Keycloak: Session fixation in OIDC login flow that can lead to account takeover
    High · 7.5 CVE-2026-7507 < 26.6.2 26.6.2
  6. Keycloak: Access token disclosure and implicit flow bypass via forged client data
    High · 7.1 CVE-2026-7571 < 26.6.2 26.6.2
  7. Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
    High · 7.4 CVE-2026-4282 < 26.5.7 26.5.7
  8. Keycloak: Application-Level DoS via Scope Processing
    High · 7.5 CVE-2026-4634 < 26.5.7 26.5.7
  9. Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
    High · 8.1 CVE-2026-4636 < 26.5.7 26.5.7
  10. Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
    High · 7.3 CVE-2026-3872 < 26.5.7 26.5.7
  11. Keycloak: Unauthorized authentication via disabled SAML Identity Provider
    High · 8.1 CVE-2026-2603 < 26.5.5 26.5.5
  12. Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
    High · 8.1 CVE-2026-3009 < 26.5.5 26.5.5
  13. Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
    High · 8.8 CVE-2026-1486 >= 26.5.0, < 26.5.3, < 26.4.9 26.5.3, 26.4.9
  14. Keycloak affected by improper invitation token validation
    High · 8.1 CVE-2026-1529 >= 26.5.0, < 26.5.3, < 26.2.13, >= 26.3.0, < 26.4.9 26.5.3, 26.2.13, 26.4.9
  15. Keycloak hostname verification
    High · 8.2 CVE-2025-3501 < 26.2.2 26.2.2
  16. org.keycloak:keycloak-services has Inefficient Regular Expression Complexity
    High · 6.5 CVE-2024-10270 < 24.0.9, >= 25.0.0, < 26.0.6 24.0.9, 26.0.6
  17. Keycloak has session fixation in Elytron SAML adapters
    High · 7.1 CVE-2024-7341 < 22.0.12, >= 23.0.0, < 24.0.7, >= 25.0.0, < 25.0.5 22.0.12, 24.0.7, 25.0.5
  18. Keycloak's admin API allows low privilege users to use administrative functions
    High · 8.1 CVE-2024-3656 < 24.0.5 24.0.5
  19. Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
    High · 7.5 CVE-2024-4540 < 24.0.5 24.0.5
  20. Keycloak path traversal vulnerability in redirection validation
    High · 8.1 CVE-2024-1132 < 22.0.10, >= 23.0.0, < 24.0.3 22.0.10, 24.0.3
Show more (9) Showing 20 of 29

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.