CVE-2026-7504 Details

A vulnerability exists in Keycloak's URL validation during redirect operations. This flaw allows attackers to bypass validation and redirect users to unauthorized URLs, potentially exposing sensitive information or facilitating further attacks. The issue specifically affects Keycloak clients with wildcards in the 'Valid Redirect URIs' field and requires user interaction to exploit. The vulnerability arises from a mismatch between Keycloak's handling of URLs and Java's URI parsing, particularly in the user-info component. Attackers can craft malicious redirect URLs that exploit this discrepancy, leading to open redirection.

To address this vulnerability, avoid using wildcard characters in the 'Valid Redirect URIs' field for Keycloak clients. Instead, explicitly list all allowed redirect URIs. Review client configurations to ensure wildcards are not used unless absolutely necessary, and if they are, ensure the application can handle open redirect vulnerabilities. Note that changes to client configurations may require a restart or reload of the Keycloak service, which could impact active user sessions.