GHSA-22rm-wp4x-v5cx
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.keycloak:keycloak-services | >= 26.5.0, < 26.6.3 | 26.6.3 |
| Maven | org.keycloak:keycloak-services | < 26.4.13 | 26.4.13 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2026-4874
- https://github.com/keycloak/keycloak/issues/47935
- https://github.com/keycloak/keycloak/pull/49682
- https://github.com/keycloak/keycloak/pull/49685
- https://github.com/keycloak/keycloak/commit/00dd0dd716c4319d3bac3eb2f2ac22d2a94f79fd
- https://github.com/keycloak/keycloak/commit/63de0efd351a7a684212a042a12271908f63f0ee
- https://access.redhat.com/errata/RHSA-2026:25097
- https://access.redhat.com/errata/RHSA-2026:25098
- https://access.redhat.com/errata/RHSA-2026:30049
- https://access.redhat.com/errata/RHSA-2026:30050
- https://access.redhat.com/security/cve/CVE-2026-4874
- https://bugzilla.redhat.com/show_bug.cgi?id=2451611
- https://github.com/keycloak/keycloak