Path Traversal Vulnerability in Keycloak by Red Hat
CVE-2026-3872
7.3HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 2 April 2026
What is CVE-2026-3872?
A significant flaw has been identified in Keycloak that enables an attacker to manipulate redirect URIs using wildcards. If an attacker controls a different path on the same server, they can bypass existing protections, potentially leading to unauthorized access and the theft of access tokens. This may result in sensitive information being disclosed, thus compromising user security and data confidentiality.
Affected Version(s)
Red Hat build of Keycloak 26.2 26.2.15-1
Red Hat build of Keycloak 26.2 26.2-18
Red Hat build of Keycloak 26.2 26.2-18