6.8
MediumCVSS 3.1 · from redhat
CVE-2026-118425
Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback
keycloak-services · Open redirect · CWE-601Affectedkeycloak-services, rhbk/keycloak-rhel9, keycloak-services
FixNo fix listed yet.
PublishedOct 29, 13:58 · redhat
ScoredOct 29 · 6.8 · redhat
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data and change data. CVSS impact.
Description
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
From redhat
Affected and fixed versions
ProductAffectedFixed inkeycloak-servicesall versions–rhbk/keycloak-rhel9all versions–keycloak-servicesnot stated–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known