Path Traversal Vulnerability in Keycloak by Red Hat
CVE-2026-3872
7.3HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 2 April 2026
What is CVE-2026-3872?
A significant flaw has been identified in Keycloak that enables an attacker to manipulate redirect URIs using wildcards. If an attacker controls a different path on the same server, they can bypass existing protections, potentially leading to unauthorized access and the theft of access tokens. This may result in sensitive information being disclosed, thus compromising user security and data confidentiality.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Red Hat build of Keycloak 26.2 26.2.15-1
Red Hat build of Keycloak 26.2 26.2-18
Red Hat build of Keycloak 26.2 26.2-18