CVE-2026-3872CWE-601

Keycloak: keycloak: information disclosure due to redirect_uri validation bypass

High · published April 2, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
47.4
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00588 · 47.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-04-02T12:37Z
EPSS history
Timeline
  • 02 APR 12:37Z
    Keycloak: keycloak: information disclosure due to redirect_uri validation bypass
    cvelistv5