Flaw in Identity and Access Management Solution Affecting Keycloak by Red Hat
CVE-2026-118425

6.8MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
29 October 2026

What is CVE-2026-118425?

A flaw in the secure-redirect-uris-enforcer client policy of Keycloak, a leading identity and access management solution, allows attackers to exploit domain restrictions. When configured to permit loopback addresses, the policy fails to properly validate hostnames through DNS resolution. This oversight can be manipulated by attackers to register unauthorized redirect URIs, compromising the security of the application and potentially exposing sensitive user data.

References

https://access.redhat.com/security/cve/CVE-2026-118425
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.