~ / search / GHSA-cjm2-j6cm-6p6m

GHSA-cjm2-j6cm-6p6m

Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint

Source: GitHub Advisory Database (reviewed) High CVE-2026-3872

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 26.5.7 26.5.7

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the theft of an access token, resulting in information disclosure.

References

External links from the advisory. They lead to third-party sites.