CVE-2024-8883

CVE-2024-8883 is a medium-severity misconfiguration flaw in Keycloak, affecting Red Hat Keycloak builds and OpenShift Container Platform. It allows an attacker to redirect users to an arbitrary URL if "Valid Redirect URI" is set to http://localhost or http://127.0.0.1. This can expose sensitive authorization codes, potentially leading to session hijacking. The vulnerability has a CVSS score of 6.1, indicating low confidentiality and integrity impact with high attack complexity due to user interaction required. While no active exploitation or Metasploit modules exist, a Nuclei template for open redirect detection is available, and there is minimal community discussion or media coverage.