CVE-2026-3872
Published: 02 April 2026
Summary
CVE-2026-3872 is a high-severity Open Redirect (CWE-601) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 2.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3872 is a vulnerability in Keycloak that enables an attacker who controls another path on the same web server to bypass restrictions on allowed paths in redirect Uniform Resource Identifiers (URIs) that employ wildcards. This flaw, classified under CWE-601 (URL Redirector Abuse), can result in the theft of an access token and information disclosure. The issue carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
Exploitation requires an attacker with low privileges and control over another path on the same web server hosting Keycloak, along with network access and user interaction. A successful attack allows the bypass of wildcard-based redirect URI validations, enabling the theft of access tokens and achieving high impacts on confidentiality and integrity, such as unauthorized access to protected resources.
Red Hat has issued multiple errata to address this vulnerability, including RHSA-2026:6475, RHSA-2026:6476, RHSA-2026:6477, and RHSA-2026:6478. Further details on the CVE, including mitigation guidance, are available at https://access.redhat.com/security/cve/CVE-2026-3872.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18206
Vulnerability details
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead…
more
to the theft of an access token, resulting in information disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing Keycloak enables exploitation for initial access (T1190) and directly facilitates theft of application access tokens via redirect URI bypass (T1528).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, testing, and patching of the Keycloak flaw enabling wildcard redirect URI bypasses, as addressed by Red Hat errata like RHSA-2026:6475.
Mandates rigorous validation of redirect URI inputs to prevent attackers from bypassing Keycloak's wildcard path restrictions and stealing access tokens.
Restricts the web server to essential Keycloak functionality and paths only, preventing attackers from controlling sibling paths needed to exploit the redirect bypass.