Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-1132

23
FAUCET Score

CVE-2024-1132 is a high-severity vulnerability in Keycloak and related Red Hat products, including OpenShift Container Platform, where improper URL validation in redirects allows attackers to bypass security controls. This flaw, with a CVSS score of 8.1, requires user interaction and can lead to unauthorized access to sensitive information or further attacks within the affected domain. While the vulnerability is significant, there is currently no evidence of active exploitation, public exploit code, or notable community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*
1.0CPE matchmatch criteria
cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
>= 21.1.0, < 22.0.10CPE matchmatch criteria
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
>= 23.0.0, < 24.0.3CPE matchmatch criteria
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
1.0CPE matchmatch criteria
cpe:2.3:a:redhat:migration_toolkit_for_applications:1.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.1HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
5.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.55%
Probability of exploitation in next 30 days
EPSS Percentile
72.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0155 is in the 71st percentile among its peer group of 14,855 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (22)

mavenpatch availablevia ghsa
Product: org.keycloak:keycloak-servicesFixed in: 24.0.3
mavenpatch availablevia ghsa
Product: org.keycloak:keycloak-servicesFixed in: 22.0.10
redhatpatch availablevia redhat_api
Product: Migration Toolkit for Runtimes 1 on RHEL 8Fixed in: mtr/mtr-rhel8-operator:1.2-15
View patch
redhatpatch availablevia redhat_api
Product: Migration Toolkit for Runtimes 1 on RHEL 8Fixed in: mtr/mtr-web-container-rhel8:1.2-16
View patch
redhatpatch availablevia redhat_api
Product: Migration Toolkit for Runtimes 1 on RHEL 8Fixed in: mtr/mtr-web-executor-container-rhel8:1.2-14
View patch
redhatpatch availablevia redhat_api
Product: MTA-6.2-RHEL-9Fixed in: mta/mta-windup-addon-rhel9:6.2.3-2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AMQ Broker 7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AMQ Broker 7Fixed in: keycloak
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Keycloak 22Fixed in: rhbk/keycloak-operator-bundle:22.0.10-1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Keycloak 22Fixed in: rhbk/keycloak-rhel9:22-13
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Keycloak 22Fixed in: rhbk/keycloak-rhel9-operator:22-16
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Keycloak 22.0.10Fixed in: keycloak
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Single Sign-On 7.6 for RHEL 7Fixed in: rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el7sso
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Single Sign-On 7.6 for RHEL 8Fixed in: rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el8sso
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Single Sign-On 7.6 for RHEL 9Fixed in: rh-sso7-keycloak-0:18.0.13-1.redhat_00001.1.el9sso
View patch
redhatpatch availablevia redhat_api
Product: RHSSO 7.6.8Fixed in: rh-sso7-keycloak
View patch
redhatpatch availablevia redhat_api
Product: RHEL-8 based Middleware ContainersFixed in: rh-sso-7/sso76-openshift-rhel8:7.6-46
View patch
redhatpatch availablevia redhat_api
Product: Migration Toolkit for Runtimes 1 on RHEL 8Fixed in: mtr/mtr-operator-bundle:1.2-23
View patch
redhatvendor investigatingvia nvd_reference
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Fuse 7Fixed in: keycloak
redhatno patchvia redhat_api
Product: Red Hat Process Automation 7Fixed in: keycloak
redhatno patchvia redhat_api
Product: Red Hat build of Apicurio Registry 2Fixed in: keycloak

Vendor Advisories (2)

mavenGHSA-72vp-xfrc-42xmhigh

Keycloak path traversal vulnerability in redirection validation

Apr 17, 2024
redhatCVE-2024-1132Important

keycloak: path transversal in redirection validation

Apr 16, 2024

References

access.redhat.com / errata/RHSA-2024:1860
Vendor Advisory
access.redhat.com / errata/RHSA-2024:1861
Vendor Advisory
access.redhat.com / errata/RHSA-2024:1862
Vendor Advisory
access.redhat.com / errata/RHSA-2024:1864
Vendor Advisory
access.redhat.com / errata/RHSA-2024:1866
Vendor Advisory
access.redhat.com / errata/RHSA-2024:1867
Vendor Advisory
access.redhat.com / errata/RHSA-2024:1868
Vendor Advisory
access.redhat.com / errata/RHSA-2024:2945
Vendor Advisory
access.redhat.com / errata/RHSA-2024:3752
Vendor Advisory
access.redhat.com / errata/RHSA-2024:3762
Vendor Advisory
access.redhat.com / errata/RHSA-2024:3919
Vendor Advisory
access.redhat.com / errata/RHSA-2024:3989
Vendor Advisory
access.redhat.com / security/cve/CVE-2024-1132
Vendor Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingVendor Advisory