Open Redirect CVE-2026-3872

Attacker must control another path on the same web server as Keycloak. Requires authenticated user (PR:L) to click attacker-controlled link. Vulnerable when redirect URIs configured with wildcards in Keycloak.

Real-world risk is HIGH for multi-tenant or shared hosting environments where Keycloak coexists with other web applications. The CVSS 7.3 score reflects network-based attack vector with low complexity, but requires low-level authentication (PR:L) and user interaction (UI:R). This means an authenticated attacker must social-engineer a victim user into clicking a malicious authorization link. The High confidentiality and integrity impact (C:H/I:H) indicates stolen access tokens grant full victim account access. Critical risk factors: (1) Attack surface exists wherever Keycloak shares a web server with attacker-influenced content (virtual hosts, reverse proxies, container deployments). (2) Information disclosure tag confirms token theft enables downstream attacks. (3) No public exploit identified at time of analysis reduces immediate weaponization risk, but the attack concept is straightforward for skilled adversaries. EPSS data unavailable, but open redirect vulnerabilities in SSO systems historically attract exploitation due to token value. Not in CISA KEV, indicating no confirmed active exploitation campaigns. Priority depends on deployment architecture-critical for shared hosting, moderate for isolated Keycloak instances. SSVC decision factors: exploitation status is none-public, automatable is no (requires user interaction), technical impact is total (token theft = full account compromise).

An attacker registers a legitimate user account in a Keycloak-protected application and deploys a malicious web application to another path on the same web server (for example, /malicious-app/ on the same domain as Keycloak at /auth/). The attacker crafts an OAuth authorization URL exploiting the wildcard redirect URI validation flaw to redirect to their controlled path. The attacker sends this URL to a victim user via phishing email or embedded link, claiming it initiates a legitimate SSO login. When the victim clicks the link and authenticates, Keycloak's flawed validation accepts the malicious redirect URI. The authorization code or access token is sent to the attacker's controlled path, allowing immediate token theft. The attacker uses the stolen token to impersonate the victim and access protected resources or sensitive data.