CVE-2026-4874: Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the clientsessionhost parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Other sources
Blind SSRF in Keycloak’s OIDC token endpoint allows an authenticated attacker to control the clientsessionhost parameter during refresh token requests, which is then stored in the client session. When a client is configured with backchannel.logout.url using the application.session.host placeholder, Keycloak substitutes this attacker‑controlled value and issues a server‑side HTTP POST to the resulting URL on logout. This lets the attacker make HTTP requests from the Keycloak server’s network context, potentially probing internal networks, cloud metadata services, or internal APIs that are not externally reachable. Exploitation requires valid credentials to obtain a refresh token, a client using backchannel.logout.url with the placeholder, and a logout event (admin, user, or timeout).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the OIDC client configuration so that backchannel.logout.url does not use the application.session.host placeholder. This prevents Keycloak from substituting an attacker-controlled value into backchannel.logout.url and issuing a server-side HTTP POST on logout.
Keycloak OIDC client backchannel.logout.url = Do not use application.session.host placeholder - Compensating control
Restrict egress from the Keycloak server network context (e.g., firewall/egress rules) so that outbound HTTP requests to internal networks, internal APIs, or cloud metadata services are not reachable from the Keycloak server.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4874?
CVE-2026-4874 is classified as a high severity vulnerability due to its potential for allowing server-side request forgery (SSRF) attacks.
How do I fix CVE-2026-4874?
To mitigate CVE-2026-4874, ensure that you upgrade to the latest version of Keycloak where the vulnerability is patched.
What impact does CVE-2026-4874 have on my Keycloak deployment?
CVE-2026-4874 allows an authenticated attacker to manipulate the client_session_host parameter, potentially leading to unauthorized server requests.
Who is affected by CVE-2026-4874?
CVE-2026-4874 affects all versions of Keycloak that allow for OIDC token endpoint manipulation.
Is authentication required to exploit CVE-2026-4874?
Yes, an attacker must be authenticated in order to exploit CVE-2026-4874 and perform SSRF attacks.