Blind SSRF in Keycloak’s OIDC token endpoint allows an authenticated attacker to control the client_session_host parameter during refresh token requests, which is then stored in the client session. When a client is configured with backchannel.logout.url using the application.session.host placeholder, Keycloak substitutes this attacker‑controlled value and issues a server‑side HTTP POST to the resulting URL on logout. This lets the attacker make HTTP requests from the Keycloak server’s network context, potentially probing internal networks, cloud metadata services, or internal APIs that are not externally reachable. Exploitation requires valid credentials to obtain a refresh token, a client using backchannel.logout.url with the placeholder, and a logout event (admin, user, or timeout).