<story><title>Keycloak open redirect: wildcard redirect URIs can be exploited to steal tokens</title><url>https://securityblog.omegapoint.se/en/writeup-keycloak-cve-2023-6027/</url></story><parent_chain><item><author>never_inline</author><text>&amp;gt; The vulnerability affects all OAuth 2.0 clients configured with a redirect URI ending with a * in Keycloak &amp;lt; 23.0.4.&lt;p&gt;How common is a wildcard in a redirect URL?</text></item></parent_chain><comment><author>maxwellg</author><text>IME Wildcard redirect URLs have become more common in recent years due to the rise of preview environments. If you&amp;#x27;re deploying a git branch to Vercel, and you now want to log in to &amp;lt;project-name&amp;gt;-git-&amp;lt;branch-name&amp;gt;-&amp;lt;scope-slug&amp;gt;.vercel.app, then you don&amp;#x27;t want to bother with configuring a different redirect URL for every branch name. Enter the wildcard.&lt;p&gt;Ideally wildcards are only used in dev&amp;#x2F;staging environments, but if the system allows for misconfiguration, the system will be misconfigured.</text></comment>
<story><title>Keycloak open redirect: wildcard redirect URIs can be exploited to steal tokens</title><url>https://securityblog.omegapoint.se/en/writeup-keycloak-cve-2023-6027/</url></story><parent_chain><item><author>never_inline</author><text>&amp;gt; The vulnerability affects all OAuth 2.0 clients configured with a redirect URI ending with a * in Keycloak &amp;lt; 23.0.4.&lt;p&gt;How common is a wildcard in a redirect URL?</text></item></parent_chain><comment><author>pwntus_se</author><text>I&amp;#x27;ve seen it in multiple installs, and it&amp;#x27;s used by keycloak&amp;#x27;s default clients used for the admin app and for the account portals for realms.</text></comment>