A Blind Server-Side Request Forgery (SSRF) vulnerability was discovered in Keycloak within the org.keycloak.services.x509 component. When the X.509 client-certificate authenticator is enabled with CRL Distribution Point (CRLDP) or OCSP revocation checking, Keycloak attempts to fetch the CRL and OCSP responder URLs embedded in the presented client certificate before performing trust revalidation.
An unauthenticated attacker can exploit this by presenting a crafted certificate containing attacker-controlled URLs in the CRL-DP or OCSP Authority Information Access (AIA) extensions. This induces the Keycloak server to initiate outbound HTTP GET or POST requests to arbitrary internal or external endpoints. A secondary exploitation vector exists when a proxy-header cert-lookup provider is configured with proxy-trusted-addresses unset, allowing the attack to be performed via plain HTTP headers without a valid TLS connection. Successful exploitation allows an attacker to probe internal network resources or interact with internal services that are otherwise unreachable from the outside.