A flaw in the keycloak-services component of Keycloak allows an attacker to manipulate the fragment portion of a redirect URI during an OIDC authentication flow. Because the existing HTTP parameter pollution check only examines the query section, an injected fragment can introduce duplicate security parameters. If a client application accepts these injected parameters without further validation, the victim’s session may be hijacked or misattributed, leading to session fixation or account confusion.

The vulnerability affects several Red Hat‑based products: Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. Version information is not specified in the available CNA data.

The CVSS score of 3.4 indicates a low overall severity, and the EPSS score of < 1% implies a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploits have been reported. The likely attack vector is a web or network-based scenario where an attacker controls a client redirect URI and can supply a malicious fragment. Successful exploitation would require that the victim trust a client application that is misconfigured to accept wildcard redirect URIs, enabling the injection of duplicate security tokens.