{"id":"CVE-2026-118425","kind":"vulnerability","aliases":["CVE-2026-118425"],"related":[],"title":"Keycloak: redirect URI policy bypassed via hostnames resolving to loopback","description":"A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.","summary":"Keycloak's secure-redirect-uris-enforcer client policy can be bypassed when loopback addresses are allowed, because hostnames are resolved via DNS during validation. An attacker can register unauthorized redirect URIs by using a hostname that resolves to a loopback address, circumventing the domain allowlist.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","keycloak","runtime","self-hosted"],"not_affected_if":["default-config","policy-not-used"],"how_to_check":"- Check whether the `secure-redirect-uris-enforcer` client policy is enabled in the realm's client policies.\n- Check whether that policy is configured to allow loopback addresses.\n- Confirm the Keycloak version in use against the fixed versions in the sources (unknown).","fix":null,"status":"open","published_at":"2026-10-29T14:17:51+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:00+00:00","updated_at":"2026-10-29T14:26:00+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-29T14:26:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: redirect URI policy bypassed via hostnames resolving to loopback","impact":"medium","summary":"Keycloak's secure-redirect-uris-enforcer client policy can be bypassed when loopback addresses are allowed, because hostnames are resolved via DNS during validation. An attacker can register unauthorized redirect URIs by using a hostname that resolves to a loopback address, circumventing the domain allowlist.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"unauthorized redirect URIs registered, enabling token or code redirection","analyst_note":"Find the affected and fixed Keycloak versions and any upstream advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118425.","how_to_check":"- Check whether the `secure-redirect-uris-enforcer` client policy is enabled in the realm's client policies.\n- Check whether that policy is configured to allow loopback addresses.\n- Confirm the Keycloak version in use against the fixed versions in the sources (unknown).","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","policy-not-used"],"who_is_affected":"Only Keycloak deployments that use the secure-redirect-uris-enforcer client policy with loopback addresses allowed are described as exposed. The sources do not name affected or fixed versions. Teams that do not use this policy or do not allow loopback addresses are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4169,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118425':13A,16A '-2026':12A,15A 'access':87C 'address':37B,64B,101C,126C 'allow':39B,99C,128C 'allowlist':68B,115C 'attack':49B,111C 'bypass':5A,34B,113C 'circumv':65B 'client':30B,80C 'configur':97C 'cve':11A,14A 'dns':45B,107C 'domain':67B,114C 'enforc':29B,79C 'flaw':70C 'found':72C 'host':22B 'hostnam':7A,41B,58B,105C,120C 'ident':17B,85C 'issu':91C 'keycloak':1A,18B,23B,83C,103C 'loopback':10A,36B,63B,100C,125C 'manag':88C 'occur':92C 'polici':4A,31B,81C,95C 'potenti':127C 'redirect':2A,27B,53B,77C,133C 'regist':51B 'registr':130C 'resolv':8A,43B,60B,104C,122C 'restrict':116C 'runtim':19B 'secur':26B,76C 'secure-redirect-uris-enforc':25B,75C 'self':21B 'self-host':20B 'solut':89C 'unauthor':52B,132C 'uri':3A,28B,54B,78C,134C 'use':56B,118C 'valid':47B,109C 'via':6A,44B,106C","nicknames":[],"mitigations":[],"who_affected":"Only Keycloak deployments that use the secure-redirect-uris-enforcer client policy with loopback addresses allowed are described as exposed. The sources do not name affected or fixed versions. Teams that do not use this policy or do not allow loopback addresses are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118425","severity":null,"published_at":"2026-10-29T14:17:51+00:00","modified_at":"2026-10-29T14:17:51+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}