CVE-2024-7260
Keycloak-core: open redirect on account page
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks. Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.58% · top 52% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Weakness
Affected products
keycloak
- affected < 24.0.7
Red Hat · Red Hat Build of Keycloak
All versions: unaffected
Red Hat · Red Hat build of Keycloak 24
- unaffected 24.0.7-4 – < *
Red Hat · Red Hat build of Keycloak 24
- unaffected 24-16 – < *
Red Hat · Red Hat build of Keycloak 24
- unaffected 24-16 – < *
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.keycloak:keycloak-coreGHSA-g4gc-rh26-m3p5 (opens in a new tab)
References (4)
- RHSA-2024:6502 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2024:6503 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-7260 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2301875 (opens in a new tab)issue-trackingx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-g4gc-rh26-m3p5 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-7260)Record last updated .