-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of redirect_uri when wildcards are used. The key vulnerable function is matchesRedirects(), which originally only stripped the query parameter when checking wildcard patterns, leaving user-info and fragment components unvalidated. This allowed attackers to craft URIs with XSS payloads in these components. The patch introduced stripOffRedirectForWildcard to address this. Additionally, lowerCaseHostname's case normalization created inconsistencies with OAuth's exact string matching recommendation, though this was a secondary factor. The commit diff and CVE description directly correlate to these functions' flawed logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 23.0.3 | 23.0.3 |