CVE-2022-1970: High severity red hat keycloak vulnerability
An open redirection vulnerability (open redirect) exists in keycloak auth endpoint. URL can be mentioned as the value of redirecturi query parameter and it successfully redirects to it.
References:
https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0
Other sources
keycloak 18.0.0: open redirect in auth endpoint via the redirecturi parameter.
Rejected reason: The originally reported issue in https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0 is a known misconfiguration, and recommendation already exists in the Keycloak documentation to mitigate the issue: https://www.keycloak.org/docs/latest/serveradmin/index.html#open-redirectors.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-1970?
CVE-2022-1970 is an open redirect vulnerability found in Keycloak 18.0.0.
What is the severity of CVE-2022-1970?
CVE-2022-1970 has a severity score of 6.1, which is considered high.
How does CVE-2022-1970 impact Keycloak 18.0.0?
CVE-2022-1970 allows attackers to redirect users to malicious websites by manipulating the redirect_uri parameter in the authentication endpoint of Keycloak 18.0.0.
Is there a fix available for CVE-2022-1970?
Yes, a fix for CVE-2022-1970 is available. It is recommended to update to a version of Keycloak that is not affected by the vulnerability.
Where can I find more information about CVE-2022-1970?
You can find more information about CVE-2022-1970 on the MITRE CVE database (https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2022-1970) and the Red Hat Bugzilla page (https://bugzilla.redhat.com/show_bug.cgi?id=2092434).