Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security flaw in its authentication component allows attackers to bypass certain safety checks when a client application is configured with overly broad 'wildcard' redirect settings. This could allow an attacker to manipulate login sessions, potentially leading to account confusion or session fixation where a user's session is controlled by the attacker.
Technical details
A vulnerability exists in the keycloak-services component, specifically within the RedirectUtils.containsForbiddenOidcParameters() method. While the system checks the query portion of a redirect URL for forbidden OIDC parameters (like 'code', 'state', or 'iss'), it fails to inspect the URI fragment (#). If a client is configured with a wildcard redirect URI, an attacker can craft a redirect_uri containing these parameters in the fragment. Because Keycloak appends its own parameters to the attacker-supplied fragment during the authorization response, it results in a polluted response. If the relying party application uses a 'first-wins' parsing strategy, it may trust the attacker's injected data over the legitimate security information from Keycloak.
Affected products
- Red Hat Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-29: other: Reported to Red Hat Bugzilla
- 2026-07-31: advisory: NVD and Red Hat published advisory