CVE-2023-6291
Keycloak: redirect_uri validation bypass
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Keycloak: redirect_uri validation bypass
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
- Record
CVE-2023-6291- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-601
- Updated
- 2026-11-04
EUVDEUVD-2023-3249
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
- Record
EUVD-2023-3249- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-mpwq-j3xf-7m5w
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "www%2ekeycloak%2eorg%2fapp%2f:[email protected]" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.
Acknowledgements
Karel Knibbe
- Record
GHSA-mpwq-j3xf-7m5w- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
- Record
CVE-2023-6291- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-601
- Updated
- 2026-11-04
OSV
Keycloak: redirect_uri validation bypass
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
- Record
CVE-2023-6291- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-601
- Updated
- 2026-11-05
OSVGHSA-mpwq-j3xf-7m5w
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts.
The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "www%2ekeycloak%2eorg%2fapp%2f:[email protected]" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input.
Acknowledgements
Karel Knibbe
- Record
GHSA-mpwq-j3xf-7m5w- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2023:7854
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 7
- Record
RHSA-2023:7854- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:7855
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9
- Record
RHSA-2023:7855- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:7856
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 8
- Record
RHSA-2023:7856- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:0798
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.7 security update on RHEL 7
- Record
RHSA-2024:0798- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:0799
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.7 security update on RHEL 8
- Record
RHSA-2024:0799- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:0800
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.7 security update on RHEL 9
- Record
RHSA-2024:0800- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
- redhat keycloak
- redhat migration toolkit for applications
- redhat openshift container platform
- redhat openshift container platform for ibm z
- redhat openshift container platform for linuxone
- redhat openshift container platform for power
- redhat single sign-on
- red hat migration toolkit for applications 6
- red hat migration toolkit for applications 7
- red hat openshift serverless
- red hat build of keycloak 22
- red hat build of keycloak 22.0.7
Show 12 moreShow less
- red hat data grid 8
- red hat decision manager 7
- red hat fuse 7
- red hat jboss data grid 7
- red hat jboss enterprise application platform 6
- red hat process automation 7
- red hat single sign-on 7
- red hat single sign-on 7.6 for rhel 7
- red hat single sign-on 7.6 for rhel 8
- red hat single sign-on 7.6 for rhel 9
- red hat rhel-8 based middleware containers
- red hat single sign-on 7.6.6
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven |
before 23.0.3 | 23.0.3 |
org.keycloak:keycloak-servicesMaven |
before 23.0.3, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
23.0.3 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 3 CVEs |
before 0:18.0.11-2.redhat_00003.1.el7sso | 0:18.0.11-2.redhat_00003.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 3 CVEs |
before 0:18.0.11-2.redhat_00003.1.el7sso | 0:18.0.11-2.redhat_00003.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 3 CVEs |
before 0:18.0.11-2.redhat_00003.1.el9sso | 0:18.0.11-2.redhat_00003.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 3 CVEs |
before 0:18.0.11-2.redhat_00003.1.el9sso | 0:18.0.11-2.redhat_00003.1.el9sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 3 CVEs |
before 0:18.0.11-2.redhat_00003.1.el8sso | 0:18.0.11-2.redhat_00003.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 3 CVEs |
before 0:18.0.11-2.redhat_00003.1.el8sso | 0:18.0.11-2.redhat_00003.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 8 CVEs |
before 0:18.0.12-1.redhat_00001.1.el7sso | 0:18.0.12-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 8 CVEs |
before 0:18.0.12-1.redhat_00001.1.el7sso | 0:18.0.12-1.redhat_00001.1.el7sso |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 8 CVEs |
before 0:18.0.12-1.redhat_00001.1.el8sso | 0:18.0.12-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 8 CVEs |
before 0:18.0.12-1.redhat_00001.1.el8sso | 0:18.0.12-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 8 CVEs |
before 0:18.0.12-1.redhat_00001.1.el9sso | 0:18.0.12-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 8 CVEs |
before 0:18.0.12-1.redhat_00001.1.el9sso | 0:18.0.12-1.redhat_00001.1.el9sso |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-6291 is a high vulnerability (CVSS 7.1) in Redhat Keycloak, published December 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in org.keycloak:keycloak-services 23.0.3.
References
access.redhat.com/errata/RHSA-2023:7854
Show 63 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2251407
github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w
nvd.nist.gov/vuln/detail/CVE-2023-6291
catalog.redhat.com/software/containers
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7854.json
cve.org/CVERecord?id=CVE-2023-6134
openwall.com/lists/oss-security/2023/10/20/5
lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55
Left out here: 113 versions. The JSON record has them.