CVE-2021-3856: Red Hat Keycloak

Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days.

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.

Affected products

• Red Hat Keycloak: before 15.1.0 (fixed in 15.1.0)

Published 2022-08-26. Last modified 2026-06-17.