Bug 2433727 (CVE-2026-1518)

Summary: CVE-2026-1518 keycloak: Blind Server-Side Request Forgery (SSRF) via CIBA Backchannel Notification Endpoint in Keycloak
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-01-28 08:09:45 UTC 
Blind SSRF behavior in the CIBA implementation of Keycloak. The issue arises because the backchannel_client_notification_endpoint configured during Dynamic Client Registration or client administration is not sufficiently validated before use. An attacker with high privileges (Administrator access or a valid Initial Access Token) can configure this endpoint to point to arbitrary internal URLs, including localhost or cloud metadata services. When a CIBA authentication request is initiated in ping mode, Keycloak sends a blind POST request to the configured endpoint. While the attacker cannot observe the response, the behavior allows limited influence over server-side network interactions and may enable abuse of internal services.