CVE-2023-6291: Keycloak: redirect_uri validation bypass
Vulnerability summary
CVE-2023-6291 is a high (CVSS 7.1) URL Redirection to Untrusted Site vulnerability in redhat keycloak. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 61.2% of scored vulnerabilities.
Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6Timeline
- 26-01-2024PublishedVulnerability first disclosed.
- 22-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
- NVDNIST7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS trend
Probability
0.95%
Chance of exploitation in the next 30 days
Percentile
61%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.95% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat7 products
- keycloak< 22.0.7
- migration_toolkit_for_applications6.0 | 7.0
- openshift_container_platform4.11 | 4.12
- openshift_container_platform_for_ibm_z4.9 | 4.10
- openshift_container_platform_for_linuxone4.9 | 4.10
Org.keycloak1 product
- keycloak-services< 23.0.3
2 vendors · 8 products
References
18 linksShow all 18 references
- github.com/keycloak/keycloakPACKAGE