CVE-2024-1132 is a path traversal vulnerability in Keycloak's redirect URL validation mechanism. It occurs when Keycloak does not properly validate URLs in redirect requests, particularly when clients use wildcards in the Valid Redirect URIs configuration. This improper validation can be exploited by attackers to bypass restrictions and access unauthorized URLs or sensitive information within the domain. The vulnerability requires user interaction to trigger the malicious redirect. Red Hat Single Sign-On 7.6.8 releases for RHEL 7 and 8 include patches that fix this issue, as documented in multiple Red Hat security advisories.

The vulnerability allows attackers to bypass redirect URL validation, potentially leading to unauthorized access to sensitive information or further attacks within the affected domain. The CVSS v3.1 score is 8.1 (High), indicating a significant impact on confidentiality and integrity, with no impact on availability. Exploitation requires no privileges but does require user interaction. There are no known exploits in the wild at the time of publication.

Red Hat has released security updates in Red Hat Single Sign-On 7.6.8 for RHEL 7 and RHEL 8 that address CVE-2024-1132. Users should apply these official patches to remediate the vulnerability. Before applying the update, ensure all previously released errata relevant to the system have been applied. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update procedures. Since this is not a cloud service, remediation is the responsibility of the system administrators. No alternative mitigations or workarounds are indicated in the vendor advisories.