Bug 2562575 (CVE-2026-118425)

Summary: CVE-2026-118425 keycloak-services: keycloak-services: Redirect URI domain allowlist bypass via DNS resolution to loopback
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-28 05:36:18 UTC 
A vulnerability was found in the Keycloak keycloak-services component. When the secure-redirect-uris-enforcer client policy is configured with allow-permitted-domains and allow-ipv4-loopback-address enabled, the validation logic performs DNS resolution on redirect URI hostnames. If an external hostname resolves to an IPv4 loopback address such as 127.0.0.1, Keycloak classifies it as a loopback URI and bypasses the domain allowlist check. Because Keycloak stores the original unnormalized hostname in the client configuration, an attacker with client update or Dynamic Client Registration access can register redirect URIs for domains outside the permitted list. This allows an attacker to redirect users to unauthorized domains, potentially leading to the exposure of sensitive authorization tokens or codes.