Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.1 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CNA (redhat) |
- CISA KEV Not listed.
- EPSS 0.021, the 82nd percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 19 Sept 2024, 15:48 UTC Confirmed by the CVE List
- 14 Oct 2024, 14:20 UTC Published by the maintainers as a GitHub repository advisory
- 31 Oct 2026, 14:17 UTC First seen by agentprime
- 31 Oct 2026, 14:17 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-w8gr-xwp4-r9f7
- OSV: GHSA-w8gr-xwp4-r9f7
- github.com/keycloak/keycloak/security/advisories/GHSA-w8gr-xwp4-r9f7
- nvd.nist.gov/vuln/detail/CVE-2024-8883
- github.com/keycloak/keycloak/releases/tag/25.0.6
- github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java
- github.com/keycloak/keycloak
- bugzilla.redhat.com/show_bug.cgi?id=2312511
- access.redhat.com/security/cve/CVE-2024-8883
- access.redhat.com/errata/RHSA-2024:8826
- access.redhat.com/errata/RHSA-2024:8824
- access.redhat.com/errata/RHSA-2024:8823
- access.redhat.com/errata/RHSA-2024:6890
- access.redhat.com/errata/RHSA-2024:6889