Bug 2430781 (CVE-2026-1180)

Summary: CVE-2026-1180 org.keycloak.protocol.oidc: Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, asoldano, bbaranow, bmaxwell, boliveir, brian.stansberry, darran.lofthouse, dosoudil, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, smaestri, ssilvert, sthorger, tom.jenkinson, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The issue allows a client to specify an arbitrary jwks_uri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the Keycloak server into making HTTP requests to internal or restricted network resources. As a result, attackers can probe internal services and cloud metadata endpoints, creating an information disclosure and reconnaissance risk.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-01-19 07:41:58 UTC 
Blind Server-Side Request Forgery (SSRF) vulnerability in the Keycloak OIDC Dynamic Client Registration flow when using private_key_jwt client authentication. The flaw is caused by the absence of validation or restriction on the jwks_uri parameter supplied during client registration. When validating a client’s JWT assertion, Keycloak automatically fetches the JWKS from the attacker-controlled URI using server-side HTTP requests. This allows remote attackers to force the Keycloak server to access internal network resources such as localhost services, RFC1918 addresses, or cloud metadata endpoints. Although responses are not directly returned, attackers can infer reachable services via timing and error behavior, enabling internal network enumeration without authentication in configurations that permit anonymous or token-based client registration.