CVE-2026-3872
published 2026-04-02CVE-2026-3872: A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform…
PriorityP343high7.3CVSS 3.1
AVNACLPRLUIRSUCHIHAN
EPSS
0.44%
35.7th percentile
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | — | — |
| redhat | build_of_keycloak | — | — |
| redhat | build_of_keycloak | — | — |
| redhat | build_of_keycloak | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
ghsa·2026-04-02
CVE-2026-3872 [HIGH] CWE-601 Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
OSV
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
osv·2026-04-02
CVE-2026-3872 [HIGH] Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Red Hat
keycloak: Keycloak: Information disclosure due to redirect_uri validation bypass
vendor_redhat·2026-04-02·CVSS 7.3
CVE-2026-3872 [HIGH] CWE-601 keycloak: Keycloak: Information disclosure due to redirect_uri validation bypass
keycloak: Keycloak: Information disclosure due to redirect_uri validation bypass
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Statement: This is an Important information disclosure flaw in Keycloak's `redirect_uri` validation logi
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2026:6475https://access.redhat.com/errata/RHSA-2026:6476https://access.redhat.com/errata/RHSA-2026:6477https://access.redhat.com/errata/RHSA-2026:6478https://access.redhat.com/security/cve/CVE-2026-3872https://bugzilla.redhat.com/show_bug.cgi?id=2445988https://access.redhat.com/errata/RHSA-2026:6475https://access.redhat.com/errata/RHSA-2026:6476https://access.redhat.com/errata/RHSA-2026:6477https://access.redhat.com/errata/RHSA-2026:6478https://access.redhat.com/security/cve/CVE-2026-3872https://bugzilla.redhat.com/show_bug.cgi?id=2445988https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3872.json
2026-04-02
Published