A vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage; this vulnerability is called an Open Redirect.

A trusted URL can fool both users and automation into believing that the URL is safe when in fact it redirects to a malicious server. This can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.

Once a crafted URL is made, it can be sent to a Keycloak admin via email for example, and it will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can target users whom they know are Keycloak admins for further attacks in this way. It may be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. Finally, the malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.