A vulnerability was found in the Keycloak keycloak-services component. When the secure-redirect-uris-enforcer client policy is configured with allow-permitted-domains and allow-ipv4-loopback-address enabled, the validation logic performs DNS resolution on redirect URI hostnames. If an external hostname resolves to an IPv4 loopback address such as 127.0.0.1, Keycloak classifies it as a loopback URI and bypasses the domain allowlist check. Because Keycloak stores the original unnormalized hostname in the client configuration, an attacker with client update or Dynamic Client Registration access can register redirect URIs for domains outside the permitted list. This allows an attacker to redirect users to unauthorized domains, potentially leading to the exposure of sensitive authorization tokens or codes.