CVE-2018-14658

medium

Description

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

References

Advisories
More

https://access.redhat.com/errata/RHSA-2018:3595

https://access.redhat.com/errata/RHSA-2018:3593

https://access.redhat.com/errata/RHSA-2018:3592

https://github.com/advisories/GHSA-3qh2-mccc-q5m6

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2233

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14658

Details

Source: Mitre, NVD

Published: 2018-11-13

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N