high7.3
CVE-2026-3872
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
Impact
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.keycloak:keycloak-services | < 26.5.7 | 26.5.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Build Of Keycloak | All versions Versions 26.2, 26.2.15, 26.4, 26.4.11 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2026:6475
- https://access.redhat.com/errata/RHSA-2026:6476
- https://access.redhat.com/errata/RHSA-2026:6477
- https://access.redhat.com/errata/RHSA-2026:6478
- https://access.redhat.com/security/cve/CVE-2026-3872
- https://bugzilla.redhat.com/show_bug.cgi?id=2445988
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3872.json
- https://github.com/advisories/GHSA-cjm2-j6cm-6p6m
- https://nvd.nist.gov/vuln/detail/CVE-2026-3872
- https://github.com/keycloak/keycloak/issues/47718
- https://github.com/keycloak/keycloak/commit/35a71b00bc856ac402711130f60190d3a24795e7