Description
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | — | — |
| Red Hat | Red Hat build of Keycloak 26.2.15 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.11 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | keycloak-26.4-iamguarded-compat | No fix yet | — |
| Wolfi rolling | keycloak-26.5 +1 | 26.5.7-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | < 26.5.7 | 26.5.7 | GHSA-cjm2-j6cm-6p6m |
Advisories 1
- WID-SEC-2026-0977 Keycloak: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
References
- RHSA-2026:6475 vendor-advisory
- RHSA-2026:6476 vendor-advisory
- RHSA-2026:6477 vendor-advisory
- RHSA-2026:6478 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-3872 vdb-entry
- RHBZ#2445988 issue-tracking