CVE-2018-14658 MEDIUM

CVE-2018-14658

Vendor Red Hat

Product keycloak

Weakness CWE-601 · Open redirect

Published November 13, 2018

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

Key dates

02Disclosure timeline

November 13, 2018 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-14658 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html

Related vulnerabilities

04Related CVE

CVE-2024-54255 WordPress Login Widget With Shortcode plugin <= 6.1.2 - Open Redirection vulnerability CVE-2023-22729 Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen CVE-2025-47454 WordPress WP Gravity Forms Dynamics CRM plugin <= 1.1.4 - Open Redirection Vulnerability CVE-2025-30885 WordPress Bit Form plugin <= 2.18.0 - Open Redirection vulnerability CVE-2023-22261 AEM URL Redirection to Untrusted Site Security feature bypass