{"id":"CVE-2024-8883","title":"A misconfiguration flaw was found in Keycloak","summary":"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as author…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-601"],"vendor":"redhat","product":"build_of_keycloak","affected":["build_of_keycloak","openshift_container_platform = 4.11","openshift_container_platform = 4.12","openshift_container_platform_for_ibm_z = 4.9","openshift_container_platform_for_ibm_z = 4.10","openshift_container_platform_for_linuxone = 4.9","openshift_container_platform_for_linuxone = 4.10","openshift_container_platform_for_power = 4.9","openshift_container_platform_for_power = 4.10","single_sign-on","single_sign-on = 7.6"],"published":"2024-09-19","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-8883","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:10385","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:10386","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6878","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6879","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6880","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6882","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6886","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6887","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6888","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6889","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:6890","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8823","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8824","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:8826","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2024-8883","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2312511","label":"secalert@redhat.com"},{"url":"https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java","label":"secalert@redhat.com"}],"tags":["nvd","exploit-available"],"epss":0.02112,"epssPercentile":0.80995,"ingestedAt":"2026-08-04T07:37:59.876Z","exploits":{"nuclei":["CVE-2024-8883"],"checkedAt":"2026-09-23T07:13:30.900Z"},"exploitAvailable":true,"slug":"CVE-2024-8883","body":"## Overview\n\nA misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.\n\n## Affected\n\n- `build_of_keycloak`\n- `openshift_container_platform = 4.11`\n- `openshift_container_platform = 4.12`\n- `openshift_container_platform_for_ibm_z = 4.9`\n- `openshift_container_platform_for_ibm_z = 4.10`\n- `openshift_container_platform_for_linuxone = 4.9`\n- `openshift_container_platform_for_linuxone = 4.10`\n- `openshift_container_platform_for_power = 4.9`\n- `openshift_container_platform_for_power = 4.10`\n- `single_sign-on`\n- `single_sign-on = 7.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":4753,"id":"CVE-2024-8883","ts":1788887203657,"field":"exploit_available","old":"false","new":"true"},{"seq":3636,"id":"CVE-2024-8883","ts":1788886319840,"field":"exploit_available","old":"true","new":"false"},{"seq":2487,"id":"CVE-2024-8883","ts":1788882988351,"field":"exploit_available","old":"false","new":"true"},{"seq":1516,"id":"CVE-2024-8883","ts":1788882401947,"field":"exploit_available","old":"true","new":"false"},{"seq":630,"id":"CVE-2024-8883","ts":1788881839686,"field":"exploit_available","old":"false","new":"true"}]}