CVE-2026-3872
A flaw was found in Keycloak.
Published Apr 2, 2026 · updated Jul 15, 2026 · redhat build of keycloak
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 2, 2026 · NIST NVD
Detected
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Jul 15, 2026 · NIST NVD
Updated
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Affected
- cpe redhat/build of keycloakversion unspecified
- cpe redhat/build of keycloak26.2
- cpe redhat/build of keycloak26.2.15
- cpe redhat/build of keycloak26.4
- cpe redhat/build of keycloak26.4.11
Sources
- CVE.orgVulnerability recordCVE-2026-3872
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3872
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting i
nvd.nist.gov