VULNERABILITY INTELLIGENCE

CVE-2026-3872

CVSS score7.3 HIGH
EPSS probability0.45%
CISA KEVNot currently listed
Published2026-04-02
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Description

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

Weakness classification

  • secalert@redhat.com: CWE-601
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-601

Primary references