---
id: "CVE-2026-118425"
kind: "vulnerability"
aliases: ["CVE-2026-118425"]
title: "Keycloak: redirect URI policy bypassed via hostnames resolving to loopback"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["identity", "keycloak", "runtime", "self-hosted"]
not_affected_if: ["default-config", "policy-not-used"]
published_at: "2026-10-29T14:17:51+00:00"
first_seen_at: "2026-10-29T14:25:23+00:00"
updated_at: "2026-10-29T14:26:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118425", "first_seen_at": "2026-10-29T14:25:23+00:00"}]
---

# Keycloak: redirect URI policy bypassed via hostnames resolving to loopback

Keycloak's secure-redirect-uris-enforcer client policy can be bypassed when loopback addresses are allowed, because hostnames are resolved via DNS during validation. An attacker can register unauthorized redirect URIs by using a hostname that resolves to a loopback address, circumventing the domain allowlist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `secure-redirect-uris-enforcer` client policy is enabled in the realm's client policies.
- Check whether that policy is configured to allow loopback addresses.
- Confirm the Keycloak version in use against the fixed versions in the sources (unknown).

## Timeline

- 2026-10-29T14:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118425

## From the sources

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_