TI-2026-06594 Aliases CVE-2026-7504 GHSA-rp95-xpg9-c2cq

Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

LOW 38CWE-601Published 2026-05-19 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited. The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00637 50th percentileScored 2026-11-07

Fix Fixed org.keycloak:keycloak-services (Maven): 26.6.2Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Red Hat	Red Hat build of Keycloak 26.2	—	26.2.16-1	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.2	—	26.2-21	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.2	—	26.2-21	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.2.16	—	—	Not affected	CNA
Red Hat	Red Hat build of Keycloak 26.4	—	26.4.12-1	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.4	—	26.4-17	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.4	—	26.4-17	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.4.12	—	—	Not affected	CNA
—	org.keycloak:keycloak-services (Maven)	before 26.6.2	26.6.2	Patch available	GHSA-rp95-xpg9-c2cq

Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2.16-1 Patch available CNA
Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2-21 Patch available CNA
Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2-21 Patch available CNA
Red Hat build of Keycloak 26.2.16 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.12-1 Patch available CNA
Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-17 Patch available CNA
Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-17 Patch available CNA
Red Hat build of Keycloak 26.4.12 VendorRed Hat Affected — Fixed in — Not affected CNA
org.keycloak:keycloak-services (Maven) Vendor— Affected before 26.6.2 Fixed in 26.6.2 Patch available GHSA-rp95-xpg9-c2cq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:redhat:build_of_keycloak::::::::	26.4 to before 26.4.12	Vulnerable	Red Hat

cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* Versions 26.4 to before 26.4.12 Vulnerable ·Red Hat

Remediation

Fix · GHSA-rp95-xpg9-c2cq org.keycloak:keycloak-services (Maven) Fixed in 26.6.2 Advisory →

Red Hat 4 advisories

RHSA-2026:19597 Released 2026-05-20 · Red Hat rating Important
Red Hat build of Keycloak 26.4.12 Images Security Update
- Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
RHSA-2026:19594 Released 2026-05-20 · Red Hat rating Important
Red Hat build of Keycloak 26.2.16 Security Update
- Red Hat build of Keycloak 26.2.16
RHSA-2026:19596 Released 2026-05-20 · Red Hat rating Important
Red Hat build of Keycloak 26.4.12 Security Update
- Red Hat build of Keycloak 26.4.12

Show 1 more Red Hat advisories

RHSA-2026:19595 Released 2026-05-20 · Red Hat rating Important
Red Hat build of Keycloak 26.2.16 Images Security Update
- Red Hat build of Keycloak 26.2 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-05-19
Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.16 and 2 more products — RHSA-2026:19594
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-06414 Keycloak: keycloak: denial of service via specially crafted saml inputPriority MEDIUM 40
- TI-2026-06597 Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverPriority LOW 36
Show all 3 records → Advisory →
Advisory · 2026-05-19
Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.16 and 2 more products — RHSA-2026:19595
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-06414 Keycloak: keycloak: denial of service via specially crafted saml inputPriority MEDIUM 40
- TI-2026-06597 Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverPriority LOW 36
Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat build of Keycloak 26.2	Fixed	RHSA-2026:19595
Red Hat build of Keycloak 26.2.16	Fixed	RHSA-2026:19594
Red Hat build of Keycloak 26.4	Fixed	RHSA-2026:19597
Red Hat build of Keycloak 26.4.12	Fixed	RHSA-2026:19596

Timeline

2026-10-02 Threatist record created from CVE-2026-7504
2026-10-03 Alias added: GHSA-rp95-xpg9-c2cq
2026-11-07 EPSS moved to the 50th–90th percentile

References

Advisory 7

Other 4

TI-2026-02223 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider CVSS 3.1HIGH 8.1
TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
TI-2026-13740 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction CVSS 3.1CRITICAL 9.8
TI-2026-13741 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation CVSS 3.1CRITICAL 9.1
TI-2026-13106 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation CVSS 3.1HIGH 8.8
TI-2026-02631 Authentication bypass in Red Hat build of Keycloak 26.2 CVSS 3.1HIGH 8.8

See all 110 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences