cve.bz

CVE-2026-3872

7.3 highEPSS 0.4%

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

CVSS 3.1
7.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-26)
CWE
CWE-601
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-cjm2-j6cm-6p6mMavenorg.keycloak:keycloak-services<26.5.726.5.7

References

Check your stackJSON