Executive brief
Keycloak, a widely used identity and access management tool, is vulnerable to a security bypass when configured with broad redirect rules. An attacker can trick a user into clicking a malicious link that manipulates the login process, potentially allowing the attacker to gain unauthorized access to the user's account or sensitive resources. This occurs because the system fails to properly check for duplicate information in web addresses during the authentication flow.
Technical details
A flaw exists in Keycloak's OIDC implementation within the `keycloak-services` package. When a client is configured with a wildcard redirect URI (e.g., http://localhost:8080/*), the `OIDCRedirectUriBuilder.addParam()` method fails to validate if the incoming redirect URI already contains reserved OIDC response parameters like 'code', 'state', or 'iss'. An attacker can craft an authorization URL containing these parameters; upon successful authentication, Keycloak appends its own legitimate parameters without checking for duplicates. If the client application uses a 'first-wins' parsing strategy for duplicate query parameters, it may trust the attacker-controlled values instead of the legitimate ones generated by Keycloak. This vulnerability is addressed in Keycloak 26.7.0, 26.6.5, and 26.4.14.
Affected products
- Keycloak Keycloak All versions prior to 26.7.0; specifically 26.5.0 to 26.6.4 and versions up to 26.4.7
- Red Hat Red Hat Build of Keycloak All versions
Timeline
- 2026-05-27: disclosed: Vulnerability reported and CVE-2026-9689 assigned
- 2026-05-27: advisory
- 2026-06-18: patched: Fix merged into Keycloak main branch