CVE-2023-6291 is a High severity (CVSS 7.1) flaw in the redirect_uri validation in Keycloak. It can let a request get around the hosts you explicitly allow, which can lead to a stolen access token and impersonation. Red Hat shipped Single Sign-On 7.6.6 updates, so apply the fixed build for your product.
What's affected
The NVD record names Keycloak, Red Hat Single Sign-On, and Red Hat OpenShift Container Platform 4.11 and 4.12 among the affected products. It does not give an upstream version range.
- Fixed (Red Hat Single Sign-On): version 7.6.6, delivered by security advisories for RHEL 7, 8 and 9 issued 14 December 2023 and rated Important (the RHSA-2023:7854, 7855 and 7856 pages I read).
- Other advisories: the record lists three more Red Hat advisories (RHSA-2023:7857, 7858 and 7860). I did not read them, so check them for Red Hat build of Keycloak and other products.
- Upstream Keycloak: the record does not give the fixed community version. Check the Keycloak security advisories and release notes for your release line.
- Severity: NVD scores it 7.1 High, and Red Hat rates the SSO updates Important.
The exposure depends on configuration. Clients that register broad redirect patterns, such as wildcards, give the validation logic more room to be wrong.
How to check if you're exposed
Find the Keycloak or Red Hat SSO version in each environment.
bin/kc.sh --version
rpm -qa | grep -i -E "keycloak|rh-sso"
For container deployments, check the image tag and compare it with the vendor's fixed image. For OpenShift, list the operators and workloads that bundle SSO.
Then audit the clients. In the admin console, open each client and read its valid redirect URIs. Wildcards at the end of a path, wildcards in a host, and entries for hosts you no longer use all deserve attention. Pin each client to exact URIs where the application allows it.
What to do now
- Update Red Hat Single Sign-On to 7.6.6, or Keycloak to the fixed release named in the vendor advisory for your line.
- Tighten valid redirect URIs on every client. Use exact URLs and remove wildcards and stale hosts.
- Review sign in logs for authorization requests with unexpected redirect values, and for tokens used from unusual places.
- If you cannot rule out token theft, revoke sessions and tokens for affected clients and ask users to sign in again.
- Use authorization code flow with PKCE for public clients, which limits what a stolen redirect can do.
Why it matters
The weakness is CWE-601, URL redirection to an untrusted site. In OAuth and OpenID Connect, the authorization server sends the user back to a redirect address along with a code or token. The list of allowed redirect addresses is the main defense that stops an attacker from receiving that response.
The description says the validation logic could be bypassed for otherwise explicitly allowed hosts. When that check fails, an attacker who gets a user to follow a crafted link can route the response, and the access token with it, to a place they control. Identity systems sit at the center of an environment, so one weakness here has a wide blast radius. The kev flag in the record is false and I did not find a report of exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Red Hat release fixes CVE-2023-6291?
Red Hat Single Sign-On 7.6.6, according to the RHEL 7, 8 and 9 advisories. Check the other listed advisories for different products.
What setting should I audit first?
Valid redirect URIs on each client. Remove wildcards and any hosts you no longer use.
Sources
Last reviewed: 19 October 2026.
