Read the docs
TI-2018-10521 Aliases CVE-2018-14658GHSA-3qh2-mccc-q5m6

Open redirect in Red Hat keycloak

Priority LOW 29CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

Why it matters now

EPSS 0.01097 65th percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatkeycloak3.2.1.Final—No fix listedCNA
—org.keycloak:keycloak-core (Maven)up to 3.2.1.Final—No fix listedGHSA-3qh2-mccc-q5m6
  • keycloak VendorRed Hat Affected 3.2.1.Final Fixed in — No fix listed CNA
  • org.keycloak:keycloak-core (Maven) Vendor— Affected up to 3.2.1.Final Fixed in — No fix listed GHSA-3qh2-mccc-q5m6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2018:3595 Released 2018-11-13 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.2.5 security and bug fix update
    • Red Hat Single Sign-On 7.2.5 zip
  • RHSA-2018:3593 Released 2018-11-13 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.2.5 on RHEL 7 security and bug fix update
    • Red Hat Single Sign-On 7.2 for RHEL 7 Server rh-sso7-keycloak-3.4.14-1.Final_redhat_00001.1.jbcs.el7, rh-sso7-keycloak-server-3.4.14-1.Final_redhat_00001.1.jbcs.el7
  • RHSA-2018:3592 Released 2018-11-13 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.2.5 on RHEL 6 security and bug fix update
    • Red Hat Single Sign-On 7.2 for RHEL 6 Server rh-sso7-keycloak-3.4.14-1.Final_redhat_00001.1.jbcs.el6, rh-sso7-keycloak-server-3.4.14-1.Final_redhat_00001.1.jbcs.el6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Mobile Application Platform 4AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7.2 for RHEL 6 ServerFixed RHSA-2018:3592
Red Hat Single Sign-On 7.2 for RHEL 7 ServerFixed RHSA-2018:3593
Red Hat Single Sign-On 7.2.5 zipFixed RHSA-2018:3595

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-14658
  2. 2026-10-03 Alias added: GHSA-3qh2-mccc-q5m6

References

Advisory 5

  • TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
  • TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
  • TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences