Keycloak: reflected xss via wildcard in oidc redirect_uri

4.6 CVSS

Vulnerability Description

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-6134

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Red Hat would like to thank Lauritz Holtmann (https://security.lauritz-holtmann.de/) for reporting this issue.

References

More from Red Hat

View All →

CVE-2025-9909

Aap-gateway: improper path validation in gateway allows credential exfiltration

Medium 6.7

CVE-2025-9908

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Medium 6.7

CVE-2025-9907

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Medium 6.7

CVE-2025-9901

Libsoup: improper handling of http vary header in libsoup caching

Medium 5.9

CVE-2025-9820

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Medium 4

Affected Vendor

Red Hat

View all reports →

Affected Software

Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.7, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Single Sign-On 7.6.6

Vulnerable Versions:

22.0.7-1, 22-6, 22-9, 0:18.0.11-2.redhat_00003.1.el7sso, 0:18.0.12-1.redhat_00001.1.el7sso, 0:18.0.11-2.redhat_00003.1.el8sso, 0:18.0.12-1.redhat_00001.1.el8sso, 0:18.0.11-2.redhat_00003.1.el9sso, 0:18.0.12-1.redhat_00001.1.el9sso, 7.6-38, 7.6.6-2, 7.6-41