keycloak

mirror of https://github.com/keycloak/keycloak.git synced 2025-12-20 14:00:09 -06:00

Files

Ricardo Martin 15a21bf8e4 CVE-2023-6291 keycloak: redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts (#57 )

* Remove lowercase for the hostname as recommended/advised by OAuth spec
Closes https://github.com/keycloak/keycloak/issues/25001

Signed-off-by: rmartinc <rmartinc@redhat.com>

* Strip off user-info from redirect URI when validating using wildcard
Closes https://issues.redhat.com/browse/RHBK-679

Signed-off-by: rmartinc <rmartinc@redhat.com>

---------

Signed-off-by: rmartinc <rmartinc@redhat.com>

2023-12-06 13:51:02 +01:00