CVE-2024-2419: Keycloak Auth Bypass Vulnerability

CVE-2024-2419 Overview

CVE-2024-2419 is a flaw in Keycloak's redirect_uri validation logic. Attackers can bypass the explicitly allowed hosts configured for OAuth/OpenID Connect clients. Successful exploitation enables theft of access tokens through redirection to attacker-controlled endpoints. An attacker who obtains a victim's access token can impersonate that user against protected resources. The vulnerability is classified as [CWE-601] URL Redirection to Untrusted Site (Open Redirect) and closely resembles the earlier CVE-2023-6291. Exploitation requires user interaction, typically clicking a crafted authorization request link.

Critical Impact
Bypassing redirect_uri allow-listing in Keycloak permits access token theft and user impersonation against any application relying on the identity provider.

Affected Products

Red Hat Single Sign-On / Keycloak (see Red Hat advisory RHSA-2024:1867)
Red Hat build of Keycloak distributions referenced in the Red Hat security errata
Applications using affected Keycloak versions as their OAuth 2.0 / OIDC authorization server

Discovery Timeline

2024-04-17 - CVE-2024-2419 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2419

Vulnerability Analysis

Keycloak acts as an OAuth 2.0 authorization server and OpenID Connect identity provider. Clients register one or more allowed redirect_uri values that constrain where Keycloak may send authorization codes and tokens. The validation routine that compares the incoming redirect_uri parameter against this allow-list contains a parsing flaw. Crafted URI values pass the comparison while resolving to hosts outside the allow-listed set. The behavior parallels CVE-2023-6291, indicating the underlying URI normalization logic remained partially exploitable after the prior fix. Because the redirect happens after successful authentication, the attacker receives the authorization response targeted at the legitimate user. Implicit flow tokens or codes exchanged with public clients can be captured directly by the attacker endpoint.

Root Cause

The root cause is improper validation of the redirect_uri request parameter. Keycloak's comparison logic does not fully account for URI components such as userinfo, backslashes, encoded characters, or path manipulation that resolve to a different effective host than the substring matched by the allow-list. The mismatch between the parsed authority used for matching and the authority used by the browser during redirect produces the bypass.

Attack Vector

Exploitation requires network access to a Keycloak authorization endpoint and a victim who clicks a crafted link. The attacker constructs an OAuth authorization request that embeds a redirect_uri designed to satisfy the allow-list check while redirecting the browser to an attacker-controlled host. After the victim authenticates, Keycloak appends the authorization code or token to the malicious redirect. The attacker harvests the credential and replays it to impersonate the victim. The flaw does not require attacker credentials on the Keycloak server, but it does require user interaction.

The vulnerability is documented in the Red Hat CVE-2024-2419 advisory and Red Hat Bug Report #2269371. No verified public proof-of-concept code is referenced in the advisory.

Detection Methods for CVE-2024-2419

Indicators of Compromise

Authorization requests containing redirect_uri values with unusual encodings, embedded @ userinfo segments, backslashes, or double-slash path tricks.
Token issuance events where the final redirect target host does not match any registered client redirect URI.
Outbound authorization responses sent to domains never previously observed for a given Keycloak client.
Spikes in failed token exchanges or session anomalies following user-clicked external links.

Detection Strategies

Parse Keycloak access logs for /realms/*/protocol/openid-connect/auth requests and extract the redirect_uri parameter for allow-list comparison in a SIEM rule.
Compare the effective authority of every redirect target against the registered client redirect URIs and alert on divergence.
Correlate authentication events with downstream application sessions to identify tokens that never reach the legitimate relying party.

Monitoring Recommendations

Enable Keycloak event logging for LOGIN, CODE_TO_TOKEN, and CLIENT_LOGIN events and forward to a centralized log platform.
Monitor for repeated authorization requests using the same client_id but varying redirect_uri patterns from a single source IP.
Track newly observed redirect destination domains per OAuth client and alert on first-seen hosts.

How to Mitigate CVE-2024-2419

Immediate Actions Required

Apply the Keycloak update referenced in Red Hat Security Errata RHSA-2024:1867 to all affected realms and clusters.
Audit every OAuth/OIDC client and remove wildcard or overly broad Valid Redirect URIs entries.
Rotate client secrets and invalidate active sessions for clients with permissive redirect configurations.
Notify downstream relying parties to validate token audiences and issuers strictly.

Patch Information

Red Hat addressed the issue in the Keycloak packages distributed through RHSA-2024:1867. Upstream Keycloak releases incorporating the corrected redirect_uri validation logic should be applied. Review the Red Hat CVE-2024-2419 details page for the full list of fixed package versions in each supported product stream.

Workarounds

Restrict Valid Redirect URIs to fully qualified, exact paths without wildcards until the patch is deployed.
Disable unused OAuth clients and remove legacy clients that cannot enforce strict redirect matching.
Enforce Proof Key for Code Exchange (PKCE) on all public clients to limit the value of stolen authorization codes.
Require short-lived access tokens and enable refresh token rotation to reduce the window of impersonation.

bash

# Example: tighten a Keycloak client redirect URI via kcadm.sh
kcadm.sh update clients/<client-uuid> -r <realm> \
  -s 'redirectUris=["https://app.example.com/oauth/callback"]' \
  -s 'attributes."pkce.code.challenge.method"=S256'