CVE-2026-3872
Last modified
CVE-2026-3872 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Build Of Keycloak | All versions |
| Redhat | Build Of Keycloak | 26.2 |
| Redhat | Build Of Keycloak | 26.2.15 |
| Redhat | Build Of Keycloak | 26.4 |
| Redhat | Build Of Keycloak | 26.4.11 |
References
- https://access.redhat.com/errata/RHSA-2026:6475Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6476Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6477Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6478Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-3872Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445988Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6475Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6476Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6477Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:6478Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-3872Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445988Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-3872?
How severe is CVE-2026-3872?
How do I fix CVE-2026-3872?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-38714InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 …9.8
- CVE-2026-38715InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 …9.8
- CVE-2026-38716InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 …9.8
- CVE-2026-38717InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 …9.8
- CVE-2026-38718InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 …7.5
- CVE-2026-38719OpENer v2.3-558-g1e99582 contains an out-of-bounds read vuln…6.2
- CVE-2026-38728An issue in Nodemailer smtp_server before v.3.18.3 allows a …7.5
- CVE-2026-3873Use of Hard-coded Credentials vulnerability in Avantra allow…7.2
- CVE-2026-38740Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable …5.3
- CVE-2026-38743The authenticated /ui/dags endpoint did not enforce per-DAG …4.3
- CVE-2026-3875The BetterDocs plugin for WordPress is vulnerable to Stored …6.4
- CVE-2026-38751OpenSTAManager version 2.10 and earlier contains an arbitrar…7.2
Are you affected by CVE-2026-3872?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST