Riskcovery

CVE-2026-4874

Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation

State
Published
Severity
3.1 Low
Published
Mar 26, 2026
Updated
Jun 26, 2026
Reserved
Mar 26, 2026

Read the record on cve.org

Description

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.

Scores

CVSSScoreVectorSource
3.13.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:Nredhat

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
Red Hat build of Keycloak 26.4Red Hat
  • 26.4.13-1 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat
  • 26.4-19 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat
  • 26.4-19 and laterNot affected
Red Hat build of Keycloak 26.4.13Red Hat
    Red Hat build of Keycloak 26.6Red Hat
    • 26.6.3-3 and laterNot affected
    Red Hat build of Keycloak 26.6Red Hat
    • 26.6-6 and laterNot affected
    Red Hat build of Keycloak 26.6Red Hat
    • 26.6-6 and laterNot affected
    Red Hat build of Keycloak 26.6.3Red Hat
      Red Hat Build of KeycloakRed Hat
        Red Hat Build of KeycloakRed Hat
          Red Hat JBoss Enterprise Application Platform 8Red Hat
            Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat
              Red Hat Single Sign-On 7Red Hat

                References

                Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.