CVE-2024-8883EPSS p81.2%
CVE-2024-8883CVE-2024-8883
redhat / build_of_keycloak
Description
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Scoring
| CVSS | 6.1 () |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 2.11% probability of exploitation · percentile 81.2% · 2026-10-05T12:00:23Z |
| Last modified | 2026-08-04 |