CVE-2026-3872: 
Java vulnerability analysis and mitigation

CVE-2026-3872 is a redirect URI validation bypass vulnerability in Keycloak that allows an attacker who controls another path on the same web server to bypass wildcard-based allowed redirect URI restrictions in the OIDC authentication endpoint via ..;/ path traversal. A successful attack can lead to the theft of OAuth/OIDC access tokens, resulting in information disclosure. The vulnerability was reported on March 10, 2026, and publicly disclosed on April 2, 2026. It affects the org.keycloak:keycloak-services Maven package in versions prior to 26.5.7, as well as Red Hat build of Keycloak versions prior to 26.2.15 and 26.4.11. It carries a CVSS v3.1 base score of 7.3 (High) (Red Hat CVE, Github Advisory).

The root cause is improper validation of the redirect_uri parameter in Keycloak's OIDC authorization endpoint, classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). When an OAuth client is configured with a wildcard redirect URI (e.g., https://example.com/app/*), Keycloak's validation logic fails to account for path traversal sequences such as ..;/, allowing an attacker to craft a redirect URI that appears to match the allowed wildcard pattern but actually resolves to a different path on the same server. Exploitation requires the attacker to control a separate path on the same web server as the legitimate redirect target, and requires user interaction (i.e., a victim must follow a crafted authorization link). The specific technique is documented in the GitHub Advisory as ..;/ path traversal in the OIDC auth endpoint (Github Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to redirect a victim's browser to an attacker-controlled path after authentication, capturing the OAuth/OIDC access token or authorization code included in the redirect. This results in high confidentiality impact (token theft enabling unauthorized access to protected resources) and high integrity impact (potential for account takeover or impersonation using the stolen token). Availability is not directly affected. The scope of impact is limited to the affected Keycloak instance and the applications relying on it for authentication (Github Advisory, Red Hat CVE).

1. Reconnaissance: Identify a target Keycloak instance (version < 26.5.7) with an OAuth client configured to use a wildcard redirect URI (e.g., https://legitimate.example.com/app/*).
2. Identify a controlled path: Locate or establish control over a different path on the same web server as the legitimate redirect target (e.g., https://legitimate.example.com/attacker-controlled/).
3. Craft a malicious authorization URL: Construct an OIDC authorization request with a redirect_uri parameter that uses ..;/ path traversal to bypass the wildcard validation, pointing to the attacker-controlled path (e.g., redirect_uri=https://legitimate.example.com/app/..;/attacker-controlled/capture).
4. Deliver the malicious link: Send the crafted authorization URL to a victim user via phishing, social engineering, or embedding in a web page.
5. Capture the token: When the victim authenticates, Keycloak validates the manipulated redirect_uri as matching the allowed wildcard and redirects the victim's browser — along with the access token or authorization code — to the attacker-controlled path, where it is captured.
6. Use the stolen token: Leverage the captured access token to authenticate to protected resources or APIs on behalf of the victim (Github Advisory, Red Hat Bugzilla).

• Network: Unusual OIDC authorization requests to Keycloak's /auth/realms/{realm}/protocol/openid-connect/auth endpoint containing ..;/ sequences or encoded path traversal characters (%2e%2e%3b%2f) in the redirect_uri parameter; redirects to unexpected paths on the same domain following authentication.
• Logs: Keycloak access logs showing authorization requests with redirect_uri values containing ..;/ or similar traversal patterns; successful authentication events followed by redirects to paths not matching any explicitly registered client redirect URI.
• Application: OAuth access tokens or authorization codes appearing in server logs or request parameters for paths not registered as client redirect URIs in the Keycloak admin console.

Keycloak has released version 26.5.7 of the upstream org.keycloak:keycloak-services package to address this vulnerability. Red Hat has issued patched builds: Red Hat build of Keycloak 26.2.15 (RHSA-2026:6475 for packages, RHSA-2026:6476 for OpenShift images) and Red Hat build of Keycloak 26.4.11 (RHSA-2026:6477, RHSA-2026:6478). Administrators should upgrade to the patched versions as the primary remediation. As a workaround, avoid using wildcard redirect URIs in OAuth client configurations and instead register explicit, fully-qualified redirect URIs to eliminate the attack surface (RHSA-2026:6475, RHSA-2026:6476, Github Advisory).

Red Hat rated this vulnerability as Important severity in its security advisories, bundling the fix with several other Keycloak security issues in the same release cycle (RHSA-2026:6475). The Keycloak project published a release announcement for version 26.5.7 addressing this and related issues. The vulnerability received routine coverage from vulnerability tracking services and aggregators, with no notable extraordinary community reaction or high-profile researcher commentary identified in available sources.