CVE-2018-14658
Keycloak Open Redirect
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
- Record
CVE-2018-14658- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2022-2233
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
- Record
EUVD-2022-2233- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3qh2-mccc-q5m6
Keycloak Open Redirect
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
- Record
GHSA-3qh2-mccc-q5m6- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
- Record
CVE-2018-14658- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
- Record
CVE-2018-14658- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-3qh2-mccc-q5m6
Keycloak Open Redirect
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
- Record
GHSA-3qh2-mccc-q5m6- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVRHSA-2018:3592
Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 6 security and bug fix update
- Record
RHSA-2018:3592- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2018:3593
Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 7 security and bug fix update
- Record
RHSA-2018:3593- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-coreMaven |
through 3.2.1.Final | None known |
org.keycloak:keycloak-coreMaven |
through 3.2.1.Final, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
None known |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs |
before 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs |
before 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs |
before 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs |
before 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14658 is a medium vulnerability (CVSS 6.1) in Keycloak, published November 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. No source names a fixed version.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658
access.redhat.com/errata/RHSA-2018:3592
nvd.nist.gov/vuln/detail/CVE-2018-14658
github.com/advisories/GHSA-3qh2-mccc-q5m6
Show 25 moreShow less
issues.redhat.com/browse/JBEAP-15587
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3592.json
cve.org/CVERecord?id=CVE-2018-10894
Left out here: 23 versions. The JSON record has them.