Keycloak: keycloak: information disclosure due to redirect_uri validation bypass

The core impact of CVE-2026-3872 lies in the potential for unauthorized access to sensitive information. An attacker who can control another path on the same web server as Keycloak can craft malicious redirect URIs that bypass the intended path restrictions. This bypass allows them to intercept and potentially steal access tokens, effectively gaining unauthorized access to resources protected by Keycloak. The blast radius extends to any application or service relying on Keycloak for authentication and authorization, as a compromised access token could be used to impersonate legitimate users and access protected data. This vulnerability shares similarities with other URI manipulation attacks where improper validation of redirect targets can lead to security breaches.

Organizations using Keycloak for authentication and authorization, particularly those with complex redirect URI configurations or shared hosting environments, are at risk. Environments where multiple applications share the same web server hosting Keycloak are especially vulnerable, as an attacker could exploit a vulnerability in one application to compromise Keycloak's redirect URI validation.

• java / server:

# Check Keycloak logs for unusual redirect URI patterns
grep -i 'redirect_uri' /path/to/keycloak/logs/keycloak.log

• generic web:

# Check for exposed Keycloak endpoints with potentially vulnerable redirect URIs
curl -I https://your-keycloak-instance/realms/your-realm/protocol/openid-connect/auth?client_id=your-client-id&response_type=code&redirect_uri=http://attacker.com/evil

1. 2026-04-02Disclosure

   disclosure

1. Réservé2026-03-10
2. Publiée2026-04-02
3. Modifiée2026-04-07
4. EPSS mis à jour2026-04-10

The primary mitigation for CVE-2026-3872 is to upgrade Keycloak to a patched version. Since a specific fixed version is not provided, it's crucial to consult the official Keycloak security advisories for the latest recommended version. As a temporary workaround, consider implementing stricter input validation on redirect URIs, ensuring that they conform to expected patterns and are properly sanitized. Web Application Firewalls (WAFs) can be configured to block requests with suspicious redirect URIs. Monitor Keycloak logs for unusual redirect activity and implement alerting for potential bypass attempts.