CVE-2026-3872: Keycloak: keycloak: information disclosure due to redirect_uri validation bypass
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Other sources
A flaw was found in Keycloak's redirecturi validation logic. This issue may allow bypassing the allwed path in a redirect URIs that use a wilcard. A successful attack may lead to the theft of an access token if the attacker controls another path on the same web server.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3872?
CVE-2026-3872 has been classified as a high severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2026-3872?
To mitigate CVE-2026-3872, users should upgrade to the latest version of Keycloak that addresses this vulnerability.
What are the potential impacts of CVE-2026-3872?
The impact of CVE-2026-3872 can lead to unauthorized access to sensitive information through redirect URI validation bypass.
Which versions of Keycloak are affected by CVE-2026-3872?
CVE-2026-3872 affects specific versions of the Red Hat Build of Keycloak, including 26.2 and 26.4.
Can CVE-2026-3872 be exploited remotely?
Yes, CVE-2026-3872 can be remotely exploited by an attacker who controls another path on the same web server.