Live › vulnerability › CVE-2026-118425
Keycloak's secure-redirect-uris-enforcer client policy can be bypassed when loopback addresses are allowed, because hostnames are resolved via DNS during validation. An attacker can register unauthorized redirect URIs by using a hostname that resolves to a loopback address, circumventing the domain allowlist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Only Keycloak deployments that use the secure-redirect-uris-enforcer client policy with loopback addresses allowed are described as exposed. The sources do not name affected or fixed versions. Teams that do not use this policy or do not allow loopback addresses are not described as affected.
No product ranges from the sources yet.
secure-redirect-uris-enforcer client policy is enabled in the realm's client policies.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
This page as .md · .json · in your agent: get_signal("CVE-2026-118425")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.