A flaw in the secure-client-uris client policy executor in Keycloak core services allows an attacker to bypass security requirements on client configurations by using a specially crafted domain that begins with a localhost prefix. The bypass permits the use of unencrypted connections for redirect URIs, enabling interception of sensitive authentication codes. The weakness is an instance of improper input validation (CWE-20).

Affected vendors include Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. The flaw impacts any deployed instance of these Red Hat products that relies on Keycloak’s secure-client-uris policy to enforce HTTPS for redirect URIs, but only if the policy check incorrectly accepts localhost-prefixed domains. Version details are not specified in the CNA data.

The CVSS score of 4.2 indicates a moderate risk; the EPSS score of 0.0019 (<1%) suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the potential impact—interception of OAuth codes—can compromise authentication flows. Attackers would need to supply a malicious redirect URI that begins with a localhost prefix, so the exploit requires that the victim’s browser or application accepts such URIs. Because the flaw stems from a host validation loophole, the attack vector is likely through crafted client configuration or user interaction when a user authorizes the compromised client.