CVE-2024-1132: Keycloak Auth Bypass Vulnerability

CVE-2024-1132 Overview

CVE-2024-1132 is an open redirect and path traversal weakness in Red Hat Keycloak. The identity and access management server fails to properly validate URLs supplied in redirect parameters. Attackers can craft malicious requests that bypass redirect validation and reach other URLs within the trusted domain. The flaw affects any client configured with a wildcard entry in the Valid Redirect URIs field. Exploitation requires user interaction, such as a victim clicking a crafted link. Successful abuse allows access to sensitive information within the domain or enables follow-on attacks against authenticated sessions. Red Hat classifies this weakness under [CWE-22] (Path Traversal).

Critical Impact
An unauthenticated attacker can bypass redirect URI validation in Keycloak, redirect victims to attacker-controlled paths within the trusted domain, and potentially exfiltrate authorization codes or tokens.

Affected Products

Red Hat Build of Keycloak
Red Hat Single Sign-On 7.6
Red Hat OpenShift Container Platform 4.9, 4.10, 4.11, 4.12 (including IBM Z, LinuxONE, and Power variants)
Red Hat Migration Toolkit for Applications and Runtimes

Discovery Timeline

2024-04-17 - CVE-2024-1132 published to the National Vulnerability Database
2024-04-17 onward - Red Hat releases security advisories RHSA-2024:1860 through RHSA-2024:3989 across affected products
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1132

Vulnerability Analysis

Keycloak accepts a redirect_uri parameter during OAuth 2.0 and OpenID Connect authorization flows. The server compares this value against the list of Valid Redirect URIs configured for the client. When an operator registers a wildcard entry, Keycloak's validation routine does not fully normalize the supplied URL before matching. Attackers exploit this gap by embedding traversal sequences or crafted path segments that satisfy the wildcard check while resolving to a different location within the same domain.

Because the resulting redirect target sits inside the trusted origin, browsers and downstream applications treat the response as legitimate. Authorization codes, access tokens, and session identifiers passed through the redirect can be exposed to unintended endpoints. The vulnerability has an EPSS score of 1.552% (72nd percentile), indicating elevated likelihood of exploitation attempts.

Root Cause

The root cause is insufficient URL normalization and pattern matching in the redirect URI validator. When wildcard patterns are permitted, Keycloak does not consistently canonicalize path components before comparison. This lets crafted paths satisfy the wildcard filter while pointing outside the intended application scope [CWE-22].

Attack Vector

Exploitation follows a standard open redirect chain. An attacker crafts a link to the Keycloak authorization endpoint containing a manipulated redirect_uri value. The victim, already authenticated or willing to authenticate, clicks the link. Keycloak validates the URI against the wildcard rule, issues the authorization response, and redirects the browser to the attacker-influenced path within the trusted domain. From that landing page, attackers can harvest tokens, execute cross-site scripting when a vulnerable endpoint exists, or pivot to other resources sharing the origin.

No working proof-of-concept is published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-1132

Indicators of Compromise

Authorization requests to /realms/{realm}/protocol/openid-connect/auth containing encoded traversal sequences such as %2e%2e%2f, ..;/, or double-encoded slashes in the redirect_uri parameter
Redirect responses (HTTP 302) from Keycloak pointing to paths that differ structurally from registered client URIs
Repeated authentication attempts from a single source targeting clients known to use wildcard Valid Redirect URIs

Detection Strategies

Audit Keycloak client configurations and flag every client whose Valid Redirect URIs field contains a * wildcard
Parse Keycloak access logs and alert when the redirect_uri parameter contains encoded traversal characters, unusual path segments, or fragments that do not match approved application routes
Correlate authorization endpoint traffic with downstream requests to identify tokens delivered to unexpected paths within the trusted domain

Monitoring Recommendations

Ingest Keycloak event logs and reverse proxy access logs into a centralized analytics platform for long-term pattern detection
Monitor for spikes in LOGIN and CODE_TO_TOKEN events associated with clients that use wildcard redirect configurations
Track user-agent and referrer anomalies during OAuth flows to surface phishing chains that abuse this weakness

How to Mitigate CVE-2024-1132

Immediate Actions Required

Apply the fixed Keycloak or Red Hat Single Sign-On packages published in the Red Hat security advisories listed below
Remove wildcard entries from the Valid Redirect URIs field on every client and replace them with explicit URI values
Rotate any client secrets, refresh tokens, and session credentials issued while a vulnerable wildcard configuration was in place

Patch Information

Red Hat has released fixes across multiple advisories, including RHSA-2024:1860, RHSA-2024:1861, RHSA-2024:1862, RHSA-2024:1864, RHSA-2024:1866, RHSA-2024:1867, RHSA-2024:1868, RHSA-2024:2945, RHSA-2024:3752, RHSA-2024:3762, RHSA-2024:3919, and RHSA-2024:3989. Refer to the Red Hat CVE-2024-1132 advisory and Bugzilla #2262117 for detailed component mappings.

Workarounds

Replace wildcard Valid Redirect URIs values with fully qualified, exact-match URIs for each client where patching is not immediately possible
Enforce strict PKCE (Proof Key for Code Exchange) on all OAuth 2.0 authorization code flows to limit the value of leaked codes
Deploy a reverse proxy or web application firewall rule that rejects authorization requests whose redirect_uri parameter contains traversal or encoded slash sequences

bash

# Example: audit Keycloak clients for wildcard redirect URIs using kcadm.sh
/opt/keycloak/bin/kcadm.sh config credentials \
    --server https://sso.example.com/auth \
    --realm master \
    --user admin

/opt/keycloak/bin/kcadm.sh get clients -r <realm-name> \
    --fields clientId,redirectUris \
    | grep -B1 '\*'