Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-3872

Опубликовано: 02 апр. 2026
Источник: nvd
CVSS3: 7.3
EPSS Низкий

Описание

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:build_of_keycloak:26.2:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:build_of_keycloak:26.2.15:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:build_of_keycloak:26.4:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:build_of_keycloak:26.4.11:*:*:*:text-only:*:*:*

EPSS

Процентиль: 36%
0.0044
Низкий

7.3 High

CVSS3

Дефекты

CWE-601
CWE-601

Связанные уязвимости

CVSS3: 7.3
redhat
4 месяца назад

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

CVSS3: 7.3
debian
4 месяца назад

A flaw was found in Keycloak. This issue allows an attacker, who contr ...

CVSS3: 7.3
github
4 месяца назад

Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint

EPSS

Процентиль: 36%
0.0044
Низкий

7.3 High

CVSS3

Дефекты

CWE-601
CWE-601