This vulnerability in Red Hat Build of Keycloak involves improper validation of redirect URLs when the client configuration includes a wildcard in the "Valid Redirect URIs" field. The root cause is a mismatch between Keycloak's validation logic and the Java URI parser's handling of the user-info section of URLs containing multiple '@' characters. Java's parser fails to extract user-info correctly, causing Keycloak to fall back to a permissive wildcard check and incorrectly allow malicious redirects. Successful exploitation requires user interaction and can lead to unauthorized URL redirection.

Successful exploitation allows attackers to redirect users to untrusted URLs despite validation controls, potentially exposing sensitive information within the domain or enabling further attacks such as phishing. The CVSS score of 8.1 indicates high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high confidentiality and integrity impact. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-7504 for current remediation guidance. Until an official fix is available, avoid configuring Keycloak clients with a wildcard (*) in the "Valid Redirect URIs" field to reduce exposure. Monitor Red Hat's advisory for updates and apply official patches promptly once released.