CVE-2026-3872

Katalog CVE

CVSS 7.3 · High EPSS 0,59%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada redhat build of keycloak. Skor CVSS 3.1 7.3 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:6475 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:6476 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:6477 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:6478 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-3872 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2445988 issue tracking · advisory vendor
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3872.json