Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-28T13:13:11 keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N CWE-1288

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.

The Red Hat Product Security team has assessed the severity of this vulnerability as Low, given that it requires a specific client configuration and a non-conformant relying party to be successful. Successful exploitation allows an attacker to inject duplicate OIDC response parameters into the redirect URI fragment. The vulnerability's root cause is an incomplete validation check in RedirectUtils that fails to inspect the URI fragment for forbidden parameters. Red Hat would like to thank default-cybe for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Build of Keycloak Affected keycloak-services Red Hat Build of Keycloak Affected rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Data Grid 8 Not affected keycloak-services Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected keycloak-services Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-18209 https://nvd.nist.gov/vuln/detail/CVE-2026-18209