Vulnerability · Published Mar 26, 2026 · Assigned by redhat
CVE-2026-4874Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation
Low 3.1
In plain English
A low-severity server-side request forgery in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.6.3 | GHSA-22rm-wp4x-v5cx |
| Maven | org.keycloak:keycloak-services | 26.4.13 | GHSA-22rm-wp4x-v5cx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4 | see references |
| Red Hat | Red Hat build of Keycloak 26.4.13 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6 | see references |
| Red Hat | Red Hat build of Keycloak 26.6.3 | see references |
| Red Hat | Red Hat Build of Keycloak | see references |
| Red Hat | Red Hat Build of Keycloak | see references |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | see references |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | see references |
| Red Hat | Red Hat Single Sign-On 7 | see references |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- RHSA-2026:25097 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:25098 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:30049 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:30050 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-4874 vdb-entry, x_refsource_REDHAT
- RHBZ#2451611 issue-tracking, x_refsource_REDHAT