This vulnerability in Keycloak arises from improper validation of URLs used in redirects, specifically when clients utilize wildcards in the Valid Redirect URIs configuration. An attacker can exploit this flaw by constructing a malicious request that bypasses the intended validation, leading to unauthorized access to other URLs and sensitive information within the domain. The vulnerability requires user interaction with the crafted URL. Red Hat advisories confirm the issue affects Red Hat Single Sign-On 7.6 versions and provide updated packages (7.6.8) that include fixes for this and related vulnerabilities.

Successful exploitation can lead to unauthorized access to sensitive information within the domain by bypassing redirect URI validation. This may facilitate further attacks such as phishing or session hijacking. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality and integrity impact with no availability impact.

Red Hat has released security updates for Red Hat Single Sign-On 7.6.8 on RHEL 7 and 8 that address this vulnerability. Users should apply these official patches promptly. The vendor advisories provide detailed instructions for updating. No additional mitigation is required beyond applying the provided updates.