The vulnerability lies in the SAML HTTP‑Redirect binding handling of Keycloak. When a client is configured to allow a wildcard redirect URL, an attacker can embed malicious query parameters in the authentication request. After the user authenticates, Keycloak concatenates its legitimate SAML response to the attacker‑supplied parameters, and some service providers may process these injected values instead of the authentic login data This can result in a user being logged into the wrong account or having session data overwritten, effectively allowing unauthorized access or confusion over user identity.

The affected products include Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. No specific version numbers were supplied by the CNA, so all installed releases remain potentially vulnerable until further information is released.

The CVSS score of 3.4 indicates a low severity impact, but the flaw facilitates parameter pollution that can lead to account confusion. The EPSS score is < 1% (0.00193), indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a client‑initiated SAML authentication request using the HTTP‑Redirect binding. The attacker must identify a service provider with a wildcard redirect configuration and craft a request containing malicious query parameters. Successful exploitation would require user interaction to complete authentication and relies on the service provider incorrectly handling the appended parameters.