---
id: CVE-2024-8883
title: A misconfiguration flaw was found in Keycloak
summary: >-
  A misconfiguration flaw was found in Keycloak. This issue can allow an
  attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is
  set to http://localhost or http://127.0.0.1, enabling sensitive information
  such as author…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-601
vendor: redhat
product: build_of_keycloak
affected:
  - build_of_keycloak
  - openshift_container_platform = 4.11
  - openshift_container_platform = 4.12
  - openshift_container_platform_for_ibm_z = 4.9
  - openshift_container_platform_for_ibm_z = 4.10
  - openshift_container_platform_for_linuxone = 4.9
  - openshift_container_platform_for_linuxone = 4.10
  - openshift_container_platform_for_power = 4.9
  - openshift_container_platform_for_power = 4.10
  - single_sign-on
  - single_sign-on = 7.6
published: '2024-09-19'
updated: '2026-08-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8883'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:10385'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:10386'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6878'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6879'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6880'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6882'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6886'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6887'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6888'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6889'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:6890'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:8823'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:8824'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:8826'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2024-8883'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2312511'
    label: secalert@redhat.com
  - url: >-
      https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
    label: secalert@redhat.com
tags:
  - nvd
  - exploit-available
epss: 0.02112
epssPercentile: 0.81018
ingestedAt: '2026-08-04T07:37:59.876Z'
exploits:
  nuclei:
    - CVE-2024-8883
  checkedAt: '2026-09-24T07:52:52.063Z'
exploitAvailable: true
---

## Overview

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

## Affected

- `build_of_keycloak`
- `openshift_container_platform = 4.11`
- `openshift_container_platform = 4.12`
- `openshift_container_platform_for_ibm_z = 4.9`
- `openshift_container_platform_for_ibm_z = 4.10`
- `openshift_container_platform_for_linuxone = 4.9`
- `openshift_container_platform_for_linuxone = 4.10`
- `openshift_container_platform_for_power = 4.9`
- `openshift_container_platform_for_power = 4.10`
- `single_sign-on`
- `single_sign-on = 7.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.