What is the CVSS score of CVE-2026-3872?

CVE-2026-3872 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Open Redirect are affected by CVE-2026-3872?

Red Hat Build of Keycloak contains an open redirect vulnerability (CVE-2026-3872) that allows authenticated attackers to bypass OAuth redirect validation and steal access tokens when Keycloak shares…. A patch is available.

How to fix or mitigate CVE-2026-3872?

Within 24 hours: Inventory all Keycloak deployments and document which instances share web servers with user-controllable or third-party content paths. Within 7 days: Implement strict redirect URI whitelisting (exact matching, not wildcards) and disable any unnecessary path hosting on shared servers; review Keycloak authentication logs for suspicious redirect attempts. Within 30 days: Evaluate isolating Keycloak to dedicated infrastructure, implement network-level controls to restrict redirect destinations, and establish monitoring for OAuth token exfiltration patterns; contact Red Hat for patch timeline and interim guidance.

Open Redirect CVE-2026-3872

EUVD-2026-18206 HIGH

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-04-02 redhat

GHSA-cjm2-j6cm-6p6m

Open Redirect Information Disclosure Red Hat Build Of Keycloak

7.3

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 21:07 vuln.today

cvss_changed

Patch released

Apr 04, 2026 - 08:30 nvd

Patch available

EUVD ID Assigned

Apr 02, 2026 - 13:15 euvd

EUVD-2026-18206

Analysis Generated

Apr 02, 2026 - 13:15 vuln.today

CVE Published

Apr 02, 2026 - 12:37 nvd

HIGH 7.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

53 maven packages depend on org.keycloak:keycloak-services (25 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.5.7.

DescriptionCVE.org

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

AnalysisAI

Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web server to bypass wildcard-based redirect URI validation and steal OAuth access tokens. Attack requires low complexity and user interaction (CVSS 7.3). EPSS and KEV status not available; no public exploit identified at time of analysis. This CWE-601 flaw enables token theft through maliciously crafted redirect flows, posing significant risk to SSO deployments where Keycloak shares a web server with attacker-controllable content.

Technical ContextAI

Keycloak is Red Hat's open-source identity and access management solution implementing OAuth 2.0, OpenID Connect, and SAML protocols. This vulnerability exploits CWE-601 (URL Redirection to Untrusted Site) in Keycloak's redirect URI validation logic. OAuth 2.0 authorization flows use redirect URIs to return authorization codes and tokens to client applications. Keycloak supports wildcard patterns in allowed redirect URIs for deployment flexibility. The flaw occurs when an attacker controls another path on the same web server hosting Keycloak-the wildcard validation can be bypassed to redirect the authorization flow to the attacker-controlled path. This breaks the fundamental OAuth security assumption that redirect URIs are pre-registered and trusted, allowing token interception. The affected product per CPE data is Red Hat Build of Keycloak (cpe:2.3:a:red_hat:red_hat_build_of_keycloak), Red Hat's commercially supported Keycloak distribution.

RemediationAI

Consult Red Hat's official security advisory at https://access.redhat.com/security/cve/CVE-2026-3872 and associated Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2445988 for vendor-released patch details and exact fixed versions. Patch availability per vendor advisory; released patched version not independently confirmed from provided data. As interim mitigation, avoid using wildcard patterns in Keycloak redirect URI configurations-register exact, fully-qualified redirect URIs for each client application instead. In multi-tenant or shared hosting deployments, isolate Keycloak to a dedicated domain or subdomain with strict path controls to prevent attacker control over sibling paths. Review all registered OAuth clients to identify wildcard redirect URIs and replace with explicit allowlists. Monitor authorization flows for anomalous redirect destinations. Apply the vendor patch immediately upon release and validate redirect URI configurations post-upgrade.