Keycloak’s redirect handling contains a flaw that allows an attacker to craft a malicious redirect URL containing multiple @ characters in the user‑info section. When the redirect URI is validated, Java’s URI parser fails to extract the user‑info, causing Keycloak to rely on a wildcard comparison and incorrectly accept the URL. This results in an open redirect that can lead to phishing, credential theft, or further exploitation of the user’s session. The vulnerability is a classic CWE‑601 defect.

The flaw affects the Red Hat Build of Keycloak. It specifically impacts clients whose “Valid Redirect URIs” field contains a wildcard (*) entry. No version information is provided, so all deployments using wildcard‑based redirect URIs are potentially vulnerable.

Keycloak receives a CVSS score of 8.1, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires user interaction with a crafted redirect request; however, constructing such a request is straightforward and the widespread use of wildcard redirect URIs makes this a likely target for attackers. The attack vector involves sending a malicious URL to a user and relying on the permissive validation to redirect the user to an arbitrary site.