GHSA-cjm2-j6cm-6p6m
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
At a glance
- Published
- Updated
- CVE
- CVE-2026-3872
- Aliases
- BIT-keycloak-2026-3872
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Description
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-services | introduced 0, fixed 26.5.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-3872 ADVISORY
- https://github.com/keycloak/keycloak/issues/47718 WEB
- https://github.com/keycloak/keycloak/commit/35a71b00bc856ac402711130f60190d3a24795e7 WEB
- https://access.redhat.com/errata/RHSA-2026:6475 WEB
- https://access.redhat.com/errata/RHSA-2026:6476 WEB
- https://access.redhat.com/errata/RHSA-2026:6477 WEB
- https://access.redhat.com/errata/RHSA-2026:6478 WEB
- https://access.redhat.com/security/cve/CVE-2026-3872 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2445988 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |