Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2024-1132: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect

52
This month
HIGH 8.1WATCHLISTMITIGATEDOWNGRADEUPGRADE

CVE-2024-1132 is a high-severity flaw (CVSS 8.1) affecting build of keycloak, jboss middleware text-only advisories, keycloak. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

Why this priority

  • High severity
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score8.1 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionRequired
EPSS exploit chance1.6% (top 25%)
CISA exploited listNo
WeaknessCWE-22
Published2024-04-17
Last modified2026-08-04
Publisher (CNA): Red Hat, Inc. · Vendor: redhat

Share: LinkedIn · X · Reddit

Last updated 2026-08-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

redhat build of keycloak MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy build-of-keycloak || rpm -q build-of-keycloak || build-of-keycloak --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
redhat jboss middleware text-only advisories DOWNGRADE
Affected: 1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy jboss-middleware-text-only-advisories || rpm -q jboss-middleware-text-only-advisories || jboss-middleware-text-only-advisories --version
2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison jboss-middleware-text-only-advisories sudo apt install jboss-middleware-text-only-advisories=<VERSION_BEFORE_1.0> sudo apt-mark hold jboss-middleware-text-only-advisories
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jboss-middleware-text-only-advisories sudo dnf downgrade jboss-middleware-text-only-advisories-<VERSION_BEFORE_1.0> sudo dnf versionlock add jboss-middleware-text-only-advisories
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat keycloak UPGRADE
Affected: >= 21.1.0 and < 22.0.10 · >= 23.0.0 and < 24.0.3
Fixed in: 22.0.10, 24.0.3
Safe to downgrade to: a release before 21.1.0
1. Check installed version
apt-cache policy keycloak || rpm -q keycloak || keycloak --version
2. UPGRADE to 22.0.10 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade keycloak
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade keycloak
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 21.1.0 (Debian / Ubuntu)
apt-cache madison keycloak sudo apt install keycloak=<VERSION_BEFORE_21.1.0> sudo apt-mark hold keycloak
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list keycloak sudo dnf downgrade keycloak-<VERSION_BEFORE_21.1.0> sudo dnf versionlock add keycloak
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat migration toolkit for applications DOWNGRADE
Affected: 1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy migration-toolkit-for-applications || rpm -q migration-toolkit-for-applications || migration-toolkit-for-applications --version
2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison migration-toolkit-for-applications sudo apt install migration-toolkit-for-applications=<VERSION_BEFORE_1.0> sudo apt-mark hold migration-toolkit-for-applications
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list migration-toolkit-for-applications sudo dnf downgrade migration-toolkit-for-applications-<VERSION_BEFORE_1.0> sudo dnf versionlock add migration-toolkit-for-applications
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat migration toolkit for runtimes MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy migration-toolkit-for-runtimes || rpm -q migration-toolkit-for-runtimes || migration-toolkit-for-runtimes --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
redhat openshift container platform DOWNGRADE
Affected: 4.11 · 4.12
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.11
1. Check installed version
apt-cache policy openshift-container-platform || rpm -q openshift-container-platform || openshift-container-platform --version
2. No fixed release: DOWNGRADE to a release before 4.11 (Debian / Ubuntu)
apt-cache madison openshift-container-platform sudo apt install openshift-container-platform=<VERSION_BEFORE_4.11> sudo apt-mark hold openshift-container-platform
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list openshift-container-platform sudo dnf downgrade openshift-container-platform-<VERSION_BEFORE_4.11> sudo dnf versionlock add openshift-container-platform
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-1132?

build of keycloak: mitigate or apply the listed mitigation; jboss middleware text-only advisories: downgrade or apply the listed mitigation; keycloak: upgrade to 22.0.10, 24.0.3. Exact commands for each OS are on this page.

Is CVE-2024-1132 being exploited?

CVE-2024-1132 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-1132 affect?

CVE-2024-1132 affects build of keycloak, jboss middleware text-only advisories, keycloak. Severity is high (CVSS 8.1). A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within t

How urgent is CVE-2024-1132?

Priority 52/100. High severity; On your watchlist

Software pages

Keycloak vulnerabilities · JBoss and WildFly vulnerabilities · Red Hat OpenShift vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.