CVE-2026-7504

Vulnerability

A flaw in Keycloak's URL validation logic during redirect operations allows an open redirect when a client is configured with a wildcard (*) in the "Valid Redirect URIs" field. The issue arises from a discrepancy between Keycloak's validation and Java's URI parser when handling multiple @ characters in the user-info component of a URL. Java's parser fails to extract the user-info, leaving only the raw authority, causing Keycloak to fall back to a wildcard comparison and incorrectly permit the malicious redirect. Affected versions include Keycloak prior to 26.4.12 and 26.2.16. [1][2][3][4]

Exploitation

An attacker must craft a redirect URL containing multiple @ characters in the user-info section (e.g., http://valid.example.com@evil.com) and trick a user into clicking the malicious link. No authentication is required; the vulnerability is triggered during the OAuth2/OIDC redirect flow. [1]

Impact

Successful exploitation enables an attacker to redirect a user to an arbitrary external URL, bypassing the intended redirect URI validation. This can lead to phishing attacks, disclosure of sensitive information such as authorization codes or tokens, and facilitate further attacks. [1]

Mitigation

Red Hat released fixed versions on 2026-05-20: Keycloak 26.4.12 (RHSA-2026:19597 and RHSA-2026:19596) and Keycloak 26.2.16 (RHSA-2026:19595). Users should update to these versions. As a workaround, avoid using wildcard (*) in Valid Redirect URIs; instead, specify explicit, allowed redirect URIs. [2][3][4]