CVE-2024-2419

A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.

Published: Apr 17, 2024
Updated: May 4, 2025
CVE: CVE-2024-2419
GHSA: GHSA-mrv8-pqfj-7gp5
Severity: High
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWEs:

CWE-346
CWE-601

Affected Software
References

Software	From	Fixed in
org.keycloak / keycloak-services	-	22.0.10
org.keycloak / keycloak-services	23.0.0	24.0.3

https://access.redhat.com/errata/RHSA-2024:1867
https://access.redhat.com/security/cve/CVE-2024-2419
https://bugzilla.redhat.com/show_bug.cgi?id=2269371
https://github.com/keycloak/keycloak/security/advisories/GHSA-mrv8-pqfj-7gp5

Vulnerability Database

CVE-2024-2419

Deep Security Visibility Without the Complexity