The vulnerability CVE-2026-3872 in Red Hat build of Keycloak 26.2 involves an open redirect issue where an attacker who controls another path on the same web server can bypass the allowed path restrictions in redirect URIs that use wildcards. This flaw enables the attacker to redirect users to untrusted sites, potentially stealing access tokens and causing information disclosure. Red Hat's security advisory RHSA-2026:6475 and RHSA-2026:6476 announce the availability of Keycloak 26.2.15 packages and container images that fix this vulnerability along with others. The advisory recommends backing up existing installations before applying the update.

Successful exploitation of this vulnerability can lead to theft of access tokens, resulting in information disclosure. The CVSS 3.1 score is 7.3 (High), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality and integrity impact. There is no indication of known exploits in the wild at this time.

Red Hat has released Keycloak version 26.2.15 which includes a fix for CVE-2026-3872. Users should update to this version to remediate the vulnerability. Before applying the update, back up all existing installations, including applications, configuration files, and databases. No other specific mitigations are indicated by the vendor advisory.