VDB
CVE-2026-3872
CVE-2026-3872
PUBLISHED
CVSS 7.300000190734863 HIGH
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
EPSS 0.01% · 1.8th percentile
Risk Scores
CVSS v3.1
7.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS Score
0.01%
1.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2.15 | |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-18 |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-14 |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-14 |
| Red Hat | Red Hat build of Keycloak 26.4.11 | |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.11-1 |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2.15-1 |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-18 |
Timeline
- Apr 2, 2026 CVE Published
- Apr 2, 2026 PoC Published
- Apr 2, 2026 PoC Published
- Apr 2, 2026 Distribution Patch
- Apr 2, 2026 Security Advisory
- Apr 2, 2026 Distribution Patch
- Apr 2, 2026 Security Advisory
- Apr 2, 2026 Distribution Patch
- Apr 2, 2026 Security Advisory
- Apr 2, 2026 Distribution Patch
- Apr 2, 2026 Security Advisory
- Apr 2, 2026 Security Advisory
References
- RHSA-2026:6475 vendor-advisory
- RHSA-2026:6476 vendor-advisory
- RHSA-2026:6477 vendor-advisory
- RHSA-2026:6478 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-3872 vdb
- RHBZ#2445988 issue
- https://nvd.nist.gov/vuln/detail/CVE-2026-3872 advisory