BIT-keycloak-2026-3872

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-3872.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-keycloak-2026-3872
Aliases
Published
2026-08-25T11:42:23Z
Modified
2026-09-08T08:48:07Z
Summary
Keycloak: keycloak: information disclosure due to redirect_uri validation bypass
Details

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:text-only:*:*:*",
        "cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / keycloak

Package

Name
keycloak
Purl
pkg:bitnami/keycloak

Severity

  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
26.2.0
Fixed
26.2.1
Introduced
26.2.15
Fixed
26.3.0
Introduced
26.4.0
Fixed
26.4.1
Introduced
26.4.11
Fixed
26.5.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-3872.json"