CVE-2026-3872CWE-601
Keycloak: keycloak: information disclosure due to redirect_uri validation bypass
High · published April 2, 2026
What it is
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
The record
Technical detail
- CVSS v3.1
- 7.3 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00588 · 47.4th percentile
- Weakness
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
- Published
- 2026-04-02T12:37Z
EPSS history
Timeline