CVE-2026-7504: Red Hat Keycloak open redirect via URL validation bypass

CVE-2026-7504 · Severity: high · CVSS 8.1 · Published 2026-05-19

Keycloak, an open-source identity and access management solution, is vulnerable to a security flaw that allows attackers to redirect users to malicious websites. This occurs when Keycloak is configured to use wildcards for valid redirect addresses, allowing an attacker to trick the system into sending a user to an unauthorized external domain. If successful, this could be used in phishing campaigns to steal user credentials or sensitive session information.

Technologies: Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-7504 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7504 being exploited in the wild.
How severe is CVE-2026-7504?
High severity, with a CVSS score of 8.1, published 19 May 2026.
Which products and versions are affected?
Keycloak < 26.6.2; org.keycloak:keycloak-services (Maven) < 26.6.2, ECOSYSTEM:introduced=0,fixed=26.6.2; Red Hat build of Keycloak 26.4.x < 26.4.12, 26.2.x < 26.2.16.
Is there a fix for CVE-2026-7504?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7504 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-7504?
Check whether you run Keycloak, org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.2 or later
    # set org.keycloak:keycloak-services to 26.6.2 in your pom.xml or build.gradle

Technical details

An open redirect vulnerability exists in Keycloak's URL validation logic due to a discrepancy between Keycloak and the underlying Java URI implementation. When a redirect URL contains multiple '@' characters in the user-info component, the Java URI parser fails to correctly extract the user-info, leaving only the raw authority field. Keycloak's validation fails to detect this malformed component and falls back to a wildcard comparison, incorrectly permitting the redirect. This affects clients configured with a wildcard (*) in the 'Valid Redirect URIs' field. Exploitation requires a remote attacker to trick a user into clicking a specially crafted link. The issue is patched in Keycloak version 26.6.2 and various Red Hat build of Keycloak versions.

Affected products

  • Keycloak Keycloak < 26.6.2
  • Red Hat Red Hat build of Keycloak 26.4.x < 26.4.12, 26.2.x < 26.2.16

Identifiers

  • CVE-2026-7504
  • GHSA-rp95-xpg9-c2cq

Timeline

  • 2026-04-30: other: Bug reported to Red Hat Bugzilla
  • 2026-05-19: disclosed: CVE-2026-7504 published
  • 2026-05-19: advisory: GitHub Advisory GHSA-rp95-xpg9-c2cq published
  • 2026-05-20: patched: Red Hat released security updates (RHSA-2026:19594, RHSA-2026:19597)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.