CVE-2026-4874

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.

Score
CVSS 3.1 3.1 Low
Status
Modified - secalert@redhat.com
Published
2026-03-26
Last modified
2026-06-26
Weaknesses
CWE-918

Affected products

References

 
 
© AVABIS GmbH privacypolicy about