Read the docs
TI-2022-03468 Aliases CVE-2022-3782GHSA-g8q8-fggx-9r3q

Path traversal in Red Hat Keycloak

Priority MEDIUM 56CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 12 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05953 93rd percentileScored 2026-11-07
Fix Partial Keycloak (redhat.com): 20.0.2org.keycloak:keycloak-parent (Maven): 20.0.2Red Hat: 13 advisoriesRed Hat: 12 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatKeycloak20.0.2 to before 20.0.220.0.2Patch availableCNA
—org.keycloak:keycloak-parent (Maven)before 20.0.220.0.2Patch availableGHSA-g8q8-fggx-9r3q
  • Keycloak VendorRed Hat Affected 20.0.2 to before 20.0.2 Fixed in 20.0.2 Patch available CNA
  • org.keycloak:keycloak-parent (Maven) Vendor— Affected before 20.0.2 Fixed in 20.0.2 Patch available GHSA-g8q8-fggx-9r3q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:20.0.2:*:*:*:*:*:*:*20.0.2VulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak:20.0.2:*:*:*:*:*:*:* Versions 20.0.2 Vulnerable ·Red Hat

Remediation

  • Fix · CNA Keycloak (redhat.com) Fixed in 20.0.2
  • Fix · GHSA-g8q8-fggx-9r3q org.keycloak:keycloak-parent (Maven) Fixed in 20.0.2 Advisory →

Red Hat 13 advisories

  • RHSA-2023:3815 Released 2023-06-27 · Red Hat rating Important
    Service Registry (container images) release and security update [2.4.3 GA]
    • RHINT Service Registry 2.4.3 GA
  • RHSA-2023:3185 Released 2023-05-17 · Red Hat rating Important
    Red Hat AMQ Broker 7.10.3 release and security update
    • AMQ Broker 7.10.3
  • RHSA-2023:2135 Released 2023-05-04 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.3 security update
    • RHPAM 7.13.1 async
Show 10 more Red Hat advisories
  • RHSA-2023:2041 Released 2023-04-27 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.1 for RHEL 8 mta/mta-windup-addon-rhel8
  • RHSA-2023:1661 Released 2023-04-05 · Red Hat rating Important
    Red Hat AMQ Broker 7.11.0 release and security update
    • AMQ Broker 7.11.0
  • RHSA-2023:1285 Released 2023-03-16 · Red Hat rating Important
    Migration Toolkit for Runtimes security bug fix and enhancement update
    • Migration Toolkit for Runtimes 1 on RHEL 8
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2022:8964 Released 2022-12-13 · Red Hat rating Important
    updated rh-sso-7/sso76-openshift-rhel8 container and operator related images
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2022:8965 Released 2022-12-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.1 security update
    • Red Hat Single Sign-On 7.6.1
  • RHSA-2022:8963 Released 2022-12-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.1 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el9sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00002.1.el9sso
  • RHSA-2022:8962 Released 2022-12-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.1 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el8sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00002.1.el8sso
  • RHSA-2022:8961 Released 2022-12-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.1 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.3-1.redhat_00002.1.el7sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00002.1.el7sso

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat build of QuarkusAffectedNo fix yet
AMQ Broker 7.10.3Fixed RHSA-2023:3185
AMQ Broker 7.11.0Fixed RHSA-2023:1661
MTA 6.1 for RHEL 8Fixed RHSA-2023:2041
Middleware Containers for OpenShiftFixed RHSA-2022:8964, RHSA-2023:1047
Migration Toolkit for Runtimes 1 on RHEL 8Fixed RHSA-2023:1285
RHINT Service Registry 2.4.3 GAFixed RHSA-2023:3815
RHPAM 7.13.1 asyncFixed RHSA-2023:2135
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2022:8961
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2022:8962
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2022:8963
Red Hat Single Sign-On 7.6.1Fixed RHSA-2022:8965
Not affected: 5 products
  • MTA 6.1 for RHEL 8
  • Middleware Containers for OpenShift
  • Red Hat Data Grid 8
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3782
  2. 2026-10-03 Alias added: GHSA-g8q8-fggx-9r3q

References

Advisory 2

Other 3

  • TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
  • TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
  • TI-2020-16908 Improper authentication in keycloak CVSS 3.1MEDIUM 6.5
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences