CVE-2024-2419

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
——< 22.0.10; >= 23.0.0, < 24.0.3
Red HatRed Hat build of Keycloak 22—
Red HatRed Hat build of Keycloak 22—
Red HatRed Hat build of Keycloak 22—

References

Timeline

Published
Apr 17, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-241929.1robdns commit d76d2e6 was discovered to contain a heap overflow via the component block->filename at /src/zonefile-insertion.c.CVE-2024-241947.5robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c.CVE-2024-241957.5robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c.CVE-2024-241987.5smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c.CVE-2024-241997.5smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c.CVE-2024-24209.8LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and includingCVE-2024-242029.8An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 alCVE-2024-24219.8LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and includinCVE-2024-242139.8Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendorCVE-2024-242155.3An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information vCVE-2024-242169.8Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/mCVE-2024-24228.8LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including
CVE-2024-2419: High severity, CVSS 7.1 | Vulnix