The vulnerability CVE-2026-3872 affects Red Hat build of Keycloak 26.2 and involves an open redirect issue where an attacker who controls a different path on the same web server can bypass allowed redirect URI path restrictions that use wildcards. This flaw enables the attacker to redirect users to untrusted sites, potentially stealing access tokens and causing information disclosure. The CVSS 3.1 base score is 7.3 (High) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, indicating network attack vector, low complexity, requiring low privileges and user interaction, with high confidentiality and integrity impact but no availability impact. Red Hat has published an official security advisory and released Keycloak version 26.2.15 that addresses this vulnerability.

Successful exploitation of this vulnerability can lead to theft of access tokens due to bypass of redirect URI validation, resulting in information disclosure and potential compromise of user sessions or credentials. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at the time of publication.

Red Hat has released Keycloak version 26.2.15 which includes a fix for CVE-2026-3872. Users should back up their existing installations including applications, configuration files, and databases before applying the update. Applying this official update is the recommended remediation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.