← CVE Intelligence

CVE-2026-3872

Keycloak: keycloak: information disclosure due to redirect_uri validation bypass PUBLISHED

Description (CNA)

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2.15-1 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-18 before *
Red Hat / Red Hat build of Keycloak 26.2unaffected 26.2-18 before *
Red Hat / Red Hat build of Keycloak 26.2.15unaffected
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.11-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-14 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-14 before *
Red Hat / Red Hat build of Keycloak 26.4.11unaffected

CWE

CWE-601

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.