CVE-2024-8883: 
Java vulnerability analysis and mitigation

A misconfiguration vulnerability (CVE-2024-8883) was discovered in Keycloak, affecting various versions of Red Hat Single Sign-On and Red Hat JBoss Enterprise Application Platform. The vulnerability was disclosed on September 19, 2024, and allows attackers to redirect users to arbitrary URLs when a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1 (NVD, Red Hat Advisory).

The vulnerability is classified as a URL Redirection to Untrusted Site ('Open Redirect') issue (CWE-601). It has a CVSS v3.1 base score of 6.1 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The flaw exists in the redirect URI validation mechanism of Keycloak, specifically when handling localhost or loopback interface URLs (Red Hat Advisory).

If exploited, this vulnerability can expose sensitive information such as authorization codes to attackers, potentially leading to session hijacking. The attack requires user interaction and can compromise the confidentiality and integrity of the affected system (NVD).

Red Hat has released security updates to address this vulnerability across multiple products including Red Hat Single Sign-On 7.6, Red Hat build of Keycloak 22.0.13 and 24.0.8, and Red Hat JBoss Enterprise Application Platform 8.0. Users are advised to update to the latest versions available through the provided security advisories (Red Hat Advisory, Red Hat Advisory).