CVE-2026-9689: Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.
Other sources
Keycloak accepts redirect URIs containing pre-loaded OIDC response parameters (iss, code, state, sessionstate) when wildcard redirect URIs are configured on a client. After successful authentication, OIDCRedirectUriBuilder.addParam() appends Keycloak's own response parameters without checking for duplicates, resulting in a polluted redirect URL with duplicate parameters. Client applications using first-wins parameter parsing may trust attacker-controlled values. Successful exploitation requires - a client must have a wildcard redirect uri registered (e.g., http://localhost:8080/) - the victim must follow an attacker-crafted authorization url - the client application must use a first-wins parsing strategy for duplicate query parameters. This issue affects All versions.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Keycloak client configuration to remove wildcard redirect URIs (such as http://localhost:8080/*) and register exact, allowed redirect URI(s) only, to prevent OIDC redirect URIs from being accepted with pre-loaded OIDC response parameters (iss, code, state, session_state).
Keycloak client redirect URIs Wildcard redirect URIs (e.g., http://host/*) = Do not allow wildcard redirect URIs; use exact redirect URIs instead - Compensating control
Ensure the client applications that consume the OIDC redirect do not use first-wins parameter parsing for duplicate query parameters; handle duplicate parameters safely so attacker-controlled values cannot override legitimate response parameters.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9689?
The severity of CVE-2026-9689 is medium with a score of 4.2.
What risk does CVE-2026-9689 pose?
CVE-2026-9689 poses a risk level of 21.
How can I fix CVE-2026-9689?
To fix CVE-2026-9689, ensure that client applications are limited to specific redirect URIs.
What vulnerability does CVE-2026-9689 address?
CVE-2026-9689 addresses a flaw in Keycloak related to HTTP parameter pollution in OIDC redirect URIs.
Who is affected by CVE-2026-9689?
Users of Keycloak who have configured clients to accept broad redirect URIs are affected by CVE-2026-9689.