The vulnerability in Red Hat Build of Keycloak's keycloak-services component arises because the security mechanism intended to prevent HTTP parameter pollution only examines the query portion of redirect URLs and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can exploit this by injecting duplicate OIDC response parameters into the fragment of the redirect URI. If the relying party (client application) is not configured correctly, it may trust the injected parameters over legitimate ones, potentially causing session fixation or account confusion. The root cause is an incomplete validation check in RedirectUtils that does not inspect URI fragments for forbidden parameters. The issue requires specific client configurations and non-conformant relying parties to be exploitable.

The impact is limited to integrity loss, specifically the injection of duplicate OIDC response parameters leading to session fixation or account confusion. There is no confidentiality or availability impact. Exploitation requires a high attack complexity, no privileges, and user interaction. The vulnerability affects the integrity of authentication flows only if the client is misconfigured with a wildcard redirect URI and does not properly validate parameters.

According to the Red Hat advisory, no effective mitigation is currently available that meets criteria for ease of use, applicability, or stability. Users should ensure client applications are correctly configured to avoid trusting injected parameters. Monitor Red Hat advisories for any future patches or official fixes. Since no patch or official fix is currently provided, mitigation relies on correct client configuration and cautious deployment.