An Open Redirect vulnerability in the Red Hat build of Keycloak can be leveraged by attackers to facilitate phishing campaigns and credential theft.

The application incorrectly validates URLs during redirect operations (CWE-601), allowing an attacker to craft malicious links that redirect users to arbitrary, untrusted external sites.

Open redirect vulnerabilities are frequently used to enhance the credibility of phishing attacks, leading to potential credential harvesting and reputational damage. With a CVSS score of 8.1, the risk is elevated due to the ability to bypass security warnings by using a trusted domain as a redirector.

Immediate Action: Apply the vendor-provided security updates (RHSA-2026:19594 through RHSA-2026:19597) to reach the fixed versions.

Proactive Monitoring: Review application logs for redirect-related parameters and ensure all external redirects are validated against an allowlist.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to restrict where the application can redirect users.

Public Exploit Available: No confirmed public exploit available.

Administrators must apply the latest security patches provided by Red Hat. Given the potential for this flaw to be weaponized in phishing campaigns, timely patching is essential to maintain user trust and security.