A vulnerability in Keycloak's secure-redirect-uris-enforcer client policy allows attackers to bypass domain allowlist restrictions when the policy permits loopback addresses. This occurs because Keycloak resolves hostnames via DNS during validation, enabling an attacker to register unauthorized redirect URIs by using hostnames that resolve to loopback addresses. The flaw requires a specific client policy configuration and user interaction to exploit.