Introduction
A parser mismatch between Keycloak and Java's URI implementation lets attackers bypass redirect URI validation and send authenticated users to arbitrary destinations. For organizations that use Keycloak as their identity provider, this flaw (scored CVSS 8.1) turns a common but discouraged configuration choice, wildcard Valid Redirect URIs, into a concrete path to credential theft and phishing.
Technical information
The root cause of CVE-2026-7504 is a disagreement between Keycloak's redirect URI validation logic and the underlying Java URI parser over how to handle the user-info component of a URL when it contains multiple @ characters.
The parser mismatch
In a standard URI, the user-info component appears before the @ symbol in the authority section (e.g., user@host). When a malicious redirect URL has multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info and leaves only the raw authority field populated. Keycloak's validation checks expect the user-info to be available, and Java's parser silently drops it.
Without the user-info in the parsed result, Keycloak's validation logic cannot detect the malformed input, because the check that would normally catch suspicious user-info content never fires. Keycloak then falls back to a wildcard comparison against the configured Valid Redirect URIs. The client is configured with a wildcard (*), so the comparison succeeds and Keycloak incorrectly permits the redirect to the attacker-controlled destination.
Attack flow
Exploitation follows these steps:
- The attacker identifies a Keycloak client that has a wildcard (
*) configured in its Valid Redirect URIs field. - The attacker builds a malicious authorization request URL where the
redirect_uriparameter contains multiple@characters in the user-info section of the URI. The crafted URI points to an attacker-controlled domain while appearing to reference a legitimate one. - The attacker delivers the URL to a victim through a phishing email, a link on a compromised page, or another social engineering vector. User interaction is required: the victim must click the link or follow the malicious flow.
- Keycloak processes the authorization request and tries to validate the redirect URI. Java's
URIparser fails to extract the user-info because of the multiple@characters and leaves only the raw authority. - Keycloak's validation logic cannot inspect the user-info, so it falls back to the wildcard comparison, and the wildcard match succeeds.
- After authentication, Keycloak redirects the victim to the attacker-controlled URL, potentially exposing authorization codes, tokens, or other sensitive information.
CVSS and classification
The vulnerability has a CVSS 3.1 base score of 8.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The attack is network accessible, requires no privileges, and has low attack complexity, but it does require user interaction. Confidentiality and integrity impacts are both rated high, and availability is unaffected. The weakness is classified under CWE-601: URL Redirection to Untrusted Site ("Open Redirect").
Affected systems and versions
The vulnerability affects Keycloak deployments where clients have a wildcard (*) in the Valid Redirect URIs field. In the Red Hat ecosystem, the specific affected package identified is the Red Hat Build of Keycloak operator. Red Hat Single Sign On, which is based on the Keycloak community project, is also in scope.
The available advisory data does not specify exact affected version ranges. Organizations running any version of Keycloak with wildcard redirect URI configurations should treat their deployments as potentially vulnerable and apply the mitigations below.
Mitigation strategies
The most effective immediate mitigation is to remove wildcard characters from the Valid Redirect URIs field for every client in Keycloak. Red Hat recommends explicitly listing all allowed redirect URIs and making sure client applications are protected against open redirect vulnerabilities.
Keycloak has built-in features that enforce stricter validation:
- Administrators should use the secure redirect URIs enforcer client policy executor to restrict which redirect URIs clients can register and use.
- The Keycloak upgrading documentation stresses exact string matching: valid redirect URIs for clients should hold a separate entry for each recognized URI, rather than relying on pattern-based checks.
| Source | Recommended Measure | Implementation Details |
|---|---|---|
| Red Hat Advisory | Remove wildcards | Explicitly list all allowed redirect URIs in client settings |
| Keycloak Release Notes | Client policy executor | Use secure redirect URIs enforcer to restrict URI patterns |
| Keycloak Upgrading Guide | Exact string matching | Configure exact valid redirect URIs without wildcards for production |
Exact string matching is the strongest defense against this validation bypass. Organizations should audit every Keycloak client configuration for wildcards and replace each one with fully qualified redirect URIs.
Threat intelligence
As of publication, the available research data does not indicate that CVE-2026-7504 is being actively exploited in the wild. Neither the National Vulnerability Database nor the CVE record lists known threat actors or active campaigns using this flaw.
Open redirects are still valuable to attackers in practice. The OWASP Foundation documents how open redirects let attackers send users to untrusted URLs that may contain malware or compromise their systems. Academic research published at NDSS reports that open redirects are frequently used to enable phishing campaigns. In an identity provider like Keycloak, an open redirect during an OAuth or OIDC flow is particularly dangerous, because an attacker can use it to intercept authorization codes or tokens issued after authentication.
Organizations should prioritize reviewing and testing redirect flows, especially in environments where client configurations previously permitted wildcards.
Vendor security history
The Keycloak project ships security fixes regularly. Versions 26.5.6 (March 2026), 26.5.7 (April 2026), and 26.6.1 (April 2026) all included fixes for issues such as Server Side Request Forgery and improper access controls. The vendor provides strong security features, but relying on wildcard configurations remains a customer-managed risk that takes administrative discipline to avoid.
References
- NVD: CVE-2026-7504
- CVE Record: CVE-2026-7504
- Red Hat Security Advisory: CVE-2026-7504
- Red Hat Bugzilla: Bug 2464128
- Red Hat Single Sign On Extended Lifecycle Support
- Keycloak Release Notes
- Keycloak Upgrading Guide
- Keycloak 26.5.6 Released
- Keycloak 26.5.7 Released
- Keycloak 26.6.1 Released
- OWASP: Open Redirect
- CWE-601: URL Redirection to Untrusted Site
- NDSS: Challenging the Myth of Harmless Open Redirection (PDF)
