CVE-2026-118425
Medium · 6.8CVSS
6.8
EPSS
0.2%
Published
Oct 29, 2026
CISA due date
—
The record
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-107020 An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader… CWE-601
- CVE-2026-118656 Echo is a Go web framework. CWE-601
- CVE-2026-118658 Echo is a Go web framework. CWE-601
- CVE-2026-111031 The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied… CWE-601
- CVE-2026-117553 Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that… CWE-601
- CVE-2026-116578 Tornado is a Python web framework and asynchronous networking library. CWE-601
- CVE-2026-115537 A weakness has been identified in gedelumbung HospitalManagement up to… CWE-601
- CVE-2026-114614 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-601