A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.
Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.
A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.
Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.
Reported by CVE List V5 (cvelist).
HOL Guard can help your team monitor supply-chain activity while the upstream record is clarified.
Explore HOL GuardReported by CVE List V5 (cvelist).
HOL Guard can help your team monitor supply-chain activity while the upstream record is clarified.
Explore HOL Guard