CVE-2026-118425

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.

• CWE-601

• https://access.redhat.com/security/cve/CVE-2026-118425

Published

Oct 29, 2026

Last Modified

Nov 2, 2026

Status

Awaiting Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11840Zohocorp ManageEngine Password Manager Pro versions before 1…8.8
• CVE-2026-118403The Premium Packages WordPress plugin before 7.3.1 does not…3.7
• CVE-2026-118404The Premium Packages WordPress plugin before 7.3.1 does not…5.3
• CVE-2026-118407The Premium Packages WordPress plugin before 7.3.1 does not…5.4
• CVE-2026-11841An attacker may perform unauthenticated read and write opera…9.4
• CVE-2026-118422The Stape Conversion Tracking WordPress plugin before 2.3.11…7.1
• CVE-2026-118426In affected versions of Octopus Server with the LDAP authent…5.3
• CVE-2026-118435Out-of-bounds write vulnerability in Samsung Open Source esc…5.4
• CVE-2026-118437The BuddyForms WordPress plugin before 2.10.1 does not prope…3.7
• CVE-2026-118438The Firelight Lightbox WordPress plugin before 2.3.24 does n…6.8
• CVE-2026-11844The iVEC-IEI Virtualization Edge Computer developed by IEI I…4.9
• CVE-2026-118444Out-of-bounds read vulnerabilities in the pybddisasm Python …4.8