Keycloak OpenID Connect Redirect URL Fragment Security Bypass

Executive Summary

This vulnerability is in Keycloak's OpenID Connect (OIDC) authentication flows. The security check only checks the query part of a redirect URL and misses the fragment part. With a wildcard redirect URI, an attacker can inject duplicate security parameters into the login response. If a client app is misconfigured, it may trust the attacker's data instead of Keycloak's real security info, causing session fixation or account confusion.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Keycloak server logs for unusual redirect_uri patterns containing forbidden parameters (code, state, iss) in the fragment portion. Check client configurations for wildcard redirect URIs. Use tools like curl to test redirect_uri handling with crafted URLs containing fragments.

Useful 0 Not Useful 0

Impact Analysis

An attacker could hijack your session or confuse your account by injecting malicious parameters during login. This might allow unauthorized access to your account or data if the client application is not properly secured against such attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling session fixation or account confusion attacks. If an attacker exploits this flaw, they might gain unauthorized access to user sessions or manipulate authentication data, which could lead to violations of data protection and privacy requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Review and update client applications to ensure they validate security parameters from Keycloak correctly and do not trust injected data. Configure Keycloak clients to avoid wildcard redirect URIs and restrict redirect URIs to trusted domains only.

Useful 0 Not Useful 0