This vulnerability affects Red Hat build of Keycloak versions prior to 26.2.16 and involves improper validation of redirect URLs when a wildcard is used in the "Valid Redirect URIs" configuration. The root cause is a mismatch between how Keycloak and the underlying Java URI parser handle the user-info part of URLs with multiple '@' characters. Java's URI parser fails to extract user-info correctly, causing Keycloak's validation to fall back to wildcard matching and incorrectly allow malicious redirects. This can lead to open redirect attacks, potentially exposing sensitive information or enabling further attacks. The vulnerability has a CVSS 3.1 score of 8.1 (high severity) and requires user interaction for exploitation. Red Hat has released version 26.2.16 to address this issue.

Successful exploitation allows attackers to redirect users to unauthorized external URLs despite validation controls, potentially exposing sensitive information within the domain or facilitating additional attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. It requires user interaction and specifically targets Keycloak clients configured with wildcard redirect URIs.

Red Hat has released an official security update in Red Hat build of Keycloak version 26.2.16 that fixes this vulnerability. Users should upgrade to version 26.2.16 or later. Before applying the update, back up existing installations including applications, configuration files, and databases. No other mitigations are specified by the vendor. Patch status is confirmed by Red Hat advisories RHSA-2026:19594 and RHSA-2026:19595.