CVE-2024-7260: Red Hat Keycloak Open Redirect Vulnerability

CVE-2024-7260 Overview

CVE-2024-7260 is an open redirect vulnerability in Red Hat Keycloak, an open source identity and access management solution. Attackers craft a URL manipulating the referrer and referrer_uri parameters to redirect users from a trusted Keycloak domain to an attacker-controlled destination. Because the initial URL originates from a legitimate Keycloak endpoint, victims and automated systems may trust it. The flaw enables phishing campaigns targeting Keycloak administrators and may bypass domain-related security checks such as OAuth redirect_uri validation. This weakness is classified as URL Redirection to Untrusted Site [CWE-601].

Critical Impact
Attackers can weaponize trusted Keycloak URLs to redirect administrators to malicious sites, enabling credential theft and downstream attacks against identity infrastructure.

Affected Products

Red Hat Build of Keycloak
Red Hat Keycloak
Deployments using Keycloak as an OAuth/OIDC identity provider

Discovery Timeline

2024-09-09 - CVE-2024-7260 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7260

Vulnerability Analysis

The vulnerability resides in how Keycloak validates the referrer and referrer_uri query parameters. Keycloak accepts values in these parameters without strictly enforcing that the redirect target belongs to a registered, trusted origin. An attacker constructs a URL pointing to a legitimate Keycloak endpoint but embeds a malicious redirect target in the parameters.

When a Keycloak administrator receives the link, for example through a phishing email, the browser first contacts the trusted Keycloak host. Keycloak then issues a redirect to the attacker-controlled destination. Automated tooling that validates only the top-level domain of the URL treats the link as safe.

The redirect target can be URL-encoded to further obscure the destination. Attackers may also chain this weakness with OAuth authorization requests by supplying the crafted URL as a redirect_uri, potentially bypassing origin checks used to protect token flows.

Root Cause

The root cause is insufficient validation of user-supplied URL parameters against an allow-list of trusted destinations. Keycloak trusts the referrer and referrer_uri values to determine navigation targets without confirming that the resolved host matches a registered client or realm origin.

Attack Vector

Exploitation requires user interaction. An attacker sends a crafted URL to a Keycloak administrator through email, chat, or a compromised web page. When the administrator clicks the link, the browser follows the redirect chain from the trusted Keycloak host to the attacker's server. No authentication or elevated privileges are required to construct the URL.

Refer to the Red Hat CVE-2024-7260 advisory and the Red Hat Bug Report #2301875 for vendor technical details. No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2024-7260

Indicators of Compromise

Keycloak access logs containing requests with referrer or referrer_uri parameters that point to external, non-allow-listed hosts.
URL-encoded values inside referrer_uri that decode to attacker-controlled domains.
Inbound emails to administrators containing links to legitimate Keycloak hostnames with unusually long or encoded query strings.
OAuth authorization requests where redirect_uri contains nested URLs or encoded external targets.

Detection Strategies

Parse Keycloak HTTP access logs and flag requests where referrer or referrer_uri parameters resolve to hosts outside the organization's approved domain list.
Correlate administrator logins with immediately preceding redirects from Keycloak endpoints to external hosts.
Alert on repeated failed or unusual authentication attempts following visits to Keycloak URLs containing suspicious parameters.

Monitoring Recommendations

Enable verbose request logging for Keycloak admin console endpoints and forward logs to a centralized SIEM.
Monitor for outbound redirects from Keycloak hostnames using web proxy or DNS telemetry.
Review OAuth client configurations regularly to confirm registered redirect_uri values remain minimal and specific.

How to Mitigate CVE-2024-7260

Immediate Actions Required

Apply the Red Hat security updates referenced in RHSA-2024:6502 and RHSA-2024:6503 to all Keycloak instances.
Audit registered OAuth clients and remove wildcard or overly permissive redirect_uri entries.
Notify Keycloak administrators about the phishing vector and instruct them to inspect Keycloak links before clicking.

Patch Information

Red Hat has released fixes tracked under RHSA-2024:6502 and RHSA-2024:6503. Consult the Red Hat CVE-2024-7260 page for the complete list of fixed package versions across supported Keycloak and Red Hat Build of Keycloak releases.

Workarounds

Restrict access to the Keycloak admin console to trusted networks or VPN-only clients until patches are applied.
Deploy web application firewall rules that strip or validate referrer and referrer_uri query parameters on Keycloak endpoints.
Enforce strict, exact-match redirect_uri values for all OAuth and OIDC clients rather than pattern-based matches.
Deliver administrator awareness training focused on identifying URL manipulation and encoded redirect targets.

bash

# Example WAF rule concept: block requests where referrer_uri points off-domain
# Pseudocode for a reverse proxy rule
if ($arg_referrer_uri ~* "^https?://(?!keycloak\.example\.com)") {
    return 400;
}