CVE-2024-1132

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 8.1EPSS 2%

Published 2024-04-17Updated 2025-04-27

Vulnerability details

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CNAredhat

EPSS score history

Sources

3 links

PoC links are not available for guest users. Login to view them.

RedHat Vuln DB CVE Organization NVD Analysis

Profile

CVSS

8.1

EPSS

Published

2024-04-17

Updated

2025-04-27

CNA

redhat

Vendors

Red Hat

19 products

CPEs

cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8

cpe:/a:redhat:migration_toolkit_applications:6.2::el8

cpe:/a:redhat:migration_toolkit_applications:6.2::el9

cpe:/a:redhat:amq_broker:7.10

cpe:/a:redhat:amq_broker:7.11

cpe:/a:redhat:amq_broker:7.12

cpe:/a:redhat:build_keycloak:22::el9

cpe:/a:redhat:build_keycloak:22

cpe:/a:redhat:red_hat_single_sign_on:7.6::el7

cpe:/a:redhat:red_hat_single_sign_on:7.6::el8

cpe:/a:redhat:red_hat_single_sign_on:7.6::el9

cpe:/a:redhat:rhosemc:1.0::el8

cpe:/a:redhat:red_hat_single_sign_on:7.6

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:quarkus:2

cpe:/a:redhat:quarkus:3

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:jboss_enterprise_brms_platform:7

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:jboss_data_grid:7

cpe:/a:redhat:jboss_enterprise_application_platform:6

cpe:/a:redhat:jboss_enterprise_application_platform:7

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated