This vulnerability in Red Hat Build of Keycloak's secure-client-uris client policy executor arises from improper input validation that only checks the start of a web address rather than the full host. This allows an attacker controlling a localhost-prefixed domain to bypass security policies requiring encrypted redirect URIs. The flaw enables interception of authorization codes transmitted over cleartext HTTP. Exploitation requires Dynamic Client Registration to be enabled and control over a specific localhost-prefixed domain. Red Hat rates this vulnerability as moderate severity with a CVSS score of 4.2. No official fix or effective mitigation is currently available according to Red Hat's advisory.

An attacker who controls a localhost-prefixed domain and can register clients dynamically may bypass the secure-client-uris policy, intercepting sensitive authentication codes sent over unencrypted HTTP. This compromises confidentiality and integrity of authentication flows. The vulnerability does not affect availability. Exploitation complexity is high and requires user interaction. No known exploits are reported in the wild.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, and stability. Users should monitor the Red Hat advisory for updates. Since exploitation requires Dynamic Client Registration to be enabled, disabling this feature where possible may reduce risk. Consult Red Hat support or a Technical Account Manager for tailored guidance.