Bug 2433727 (CVE-2026-1518) - CVE-2026-1518 keycloak: Blind Server-Side Request Forgery (SSRF) via CIBA Backchannel Notification Endpoint in Keycloak
Summary: CVE-2026-1518 keycloak: Blind Server-Side Request Forgery (SSRF) via CIBA Bac...
Keywords:
Status: NEW
Alias: CVE-2026-1518
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-28 08:09 UTC by OSIDB Bzimport
Modified: 2026-02-02 07:06 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-01-28 08:09:45 UTC
Blind SSRF behavior in the CIBA implementation of Keycloak. The issue arises because the backchannel_client_notification_endpoint configured during Dynamic Client Registration or client administration is not sufficiently validated before use. An attacker with high privileges (Administrator access or a valid Initial Access Token) can configure this endpoint to point to arbitrary internal URLs, including localhost or cloud metadata services. When a CIBA authentication request is initiated in ping mode, Keycloak sends a blind POST request to the configured endpoint. While the attacker cannot observe the response, the behavior allows limited influence over server-side network interactions and may enable abuse of internal services.


Note You need to log in before you can comment on or make changes to this bug.