Bug 2451611 (CVE-2026-4874)

Summary: CVE-2026-4874 org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: Keycloak: Server-Side Request Forgery via OIDC token endpoint manipulation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, security-response-team, smaestri, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-26 05:51:36 UTC 
Blind SSRF in Keycloak’s OIDC token endpoint allows an authenticated attacker to control the client_session_host parameter during refresh token requests, which is then stored in the client session. When a client is configured with backchannel.logout.url using the application.session.host placeholder, Keycloak substitutes this attacker‑controlled value and issues a server‑side HTTP POST to the resulting URL on logout. This lets the attacker make HTTP requests from the Keycloak server’s network context, potentially probing internal networks, cloud metadata services, or internal APIs that are not externally reachable. Exploitation requires valid credentials to obtain a refresh token, a client using backchannel.logout.url with the placeholder, and a logout event (admin, user, or timeout).