CVE-2026-118425: Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable allowing loopback addresses in the secure-redirect-uris-enforcer client policy to prevent hostname resolution to loopback addresses from bypassing redirect URI domain allowlist restrictions.
Keycloak secure-redirect-uris-enforcer client policy allow loopback addresses = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments using Keycloak's secure-redirect-uris-enforcer client policy are exposed when that policy is configured to allow loopback addresses. The issue depends on Keycloak resolving hostnames through DNS during redirect URI validation.
What does an attacker need to exploit it?
An attacker needs to use a hostname that resolves to a loopback address. This can allow the hostname to bypass domain allowlist restrictions and potentially be registered as an unauthorized redirect URI.
What can be done while a fix is not available?
Avoid configuring the secure-redirect-uris-enforcer client policy to allow loopback addresses. Review registered redirect URIs for hostnames that resolve to loopback addresses and remove unauthorized entries.