EUVD-2026-51483
GHSA-6j79-4gfx-fm6f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-exploitable via crafted redirect URI (AV:N); high complexity due to domain crafting precondition (AC:H); no privileges required for the bypass itself (PR:N); user must initiate OAuth flow (UI:R); no availability impact and limited confidentiality/integrity loss.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
AnalysisAI
Redirect URI policy bypass in Keycloak's secure-client-uris executor enables interception of OAuth authorization codes over unencrypted HTTP connections. The flaw exists because the executor performs only a prefix-string comparison on the redirect URI rather than properly parsing and validating the host component, allowing a specially crafted domain name to satisfy the HTTPS enforcement check while pointing to an attacker-controlled HTTP endpoint. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Keycloak implements OAuth 2.0 and OpenID Connect flows and includes a configurable client policy framework that can enforce security constraints on client registrations - such as requiring all redirect URIs use encrypted (HTTPS) schemes. The 'secure-client-uris' executor is one such policy component. CWE-20 (Improper Input Validation) is the root cause: the executor performs a prefix-based string check on the redirect URI value (e.g., startsWith-style logic) rather than parsing the URI structure and validating the scheme and host independently. This allows an attacker to craft a domain name that causes the URI string to pass the prefix check while the actual redirect destination uses an unencrypted HTTP channel. Affected products per CPE data include cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack, and cpe:2.3:a:red_hat:red_hat_data_grid_8.
RemediationAI
Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18211 for the patched build of Keycloak and Red Hat Single Sign-On 7; no exact fixed version number is confirmed in the available data - do not infer a version. As a compensating control prior to patching, administrators can manually audit all client redirect URI configurations in affected realms and enforce that all registered redirect URIs use the https:// scheme with fully qualified, organization-controlled hostnames - rejecting any URI that passes policy but resolves to an external or attacker-registerable domain. Disabling the secure-client-uris policy while unpatched is not recommended as it removes the enforcement layer entirely. Restricting Keycloak admin console access to trusted internal networks reduces the attack surface for clients with misconfigured redirect URIs.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today