Keycloak EUVD-2026-32212

Exploitation requires two concurrent non-default conditions: first, the targeted Keycloak OAuth/OIDC client must be configured with an overly broad or permissive redirect URI pattern - exact-match URI configurations are not vulnerable; second, a legitimate user must click an attacker-crafted authorization URL (UI:R per CVSS vector). The CVSS AC:H rating explicitly confirms that exploitation is not straightforward even when these conditions are met, as the attacker must precisely engineer the parameter pollution to be resolved in their favor by the specific client application. SSVC confirms the attack is not automatable. Exploitation is further constrained to scenarios where the attacker has prior knowledge of the target application's OAuth client configuration and redirect URI pattern. Default Keycloak deployments with properly scoped redirect URIs are not affected; this is a configuration-dependent vulnerability.

The CVSS score of 4.2 (Medium) accurately reflects several significant mitigating factors embedded in the vector. AC:H (High Attack Complexity) indicates that exploitation is not straightforward and requires specific alignment of conditions - namely a misconfigured client redirect URI and user interaction. UI:R (User Interaction Required) confirms the attacker cannot exploit this autonomously; a victim must click a crafted link. The scope is unchanged (S:U) and both confidentiality and integrity impacts are rated Low (C:L/I:L), meaning the blast radius per successful exploit is constrained. EPSS at 0.08% (23rd percentile) strongly corroborates low real-world exploitation activity. SSVC further confirms: Exploitation status is none, the attack is not automatable, and technical impact is only partial. Taken together, these signals consistently point to a low-priority finding for most environments. However, for high-assurance or regulated deployments where any authentication bypass - even partial - carries outsized organizational risk, the authentication bypass tag elevates urgency. There are no conflicting signals in the available data; CVSS vector, EPSS, SSVC, and reported tag are all internally consistent.

An attacker identifies a web application protected by Keycloak whose registered OAuth client uses a broad redirect URI pattern (e.g., matching an entire domain or using a wildcard prefix). The attacker crafts a malicious OAuth authorization URL containing duplicate redirect_uri or state parameters - with the attacker-controlled value positioned to be processed preferentially by the client application - and delivers this URL to a target user via phishing email or malicious link. When the user clicks the link and completes authentication, the client application resolves the polluted parameter in the attacker's favor, potentially redirecting the authorization code or session token to an attacker-controlled endpoint. No public proof-of-concept exploit code has been identified at the time of this analysis.