Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation

The SSRF vulnerability in Keycloak Services allows an attacker, once authenticated, to craft malicious refresh token requests that manipulate the clientsessionhost parameter. If a Keycloak client is configured to use the backchannel.logout.url with the application.session.host placeholder, this manipulation enables the attacker to initiate HTTP requests originating from the Keycloak server's network context. This can lead to the exposure of sensitive information residing within the internal network, such as internal API endpoints or other internal services. The potential blast radius extends to any internal resources accessible from the Keycloak server, making it crucial to address this vulnerability promptly.

Organizations utilizing Keycloak for authentication and authorization, particularly those with complex internal network architectures or sensitive internal APIs, are at risk. Environments where the backchannel.logout.url is configured with the application.session.host placeholder are especially vulnerable.

• java / server:

# Check for suspicious outbound network connections from the Keycloak process
netstat -an | grep keycloak

• java / server:

# Monitor Keycloak logs for unusual HTTP requests or errors related to refresh token processing
grep -i "client_session_host" /path/to/keycloak/logs/keycloak.log

• generic web:

# Check for the presence of the 'application.session.host' placeholder in the backchannel.logout.url configuration
# (Requires access to Keycloak configuration files or API)

1. 2026-03-26Disclosure

   disclosure

1. Reserviert2026-03-26
2. Veröffentlicht2026-03-26
3. Geändert2026-04-13
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2026-4874 is to upgrade Keycloak Services to a version that includes the security patch. Consult the official Keycloak advisory for the specific patched version. If immediate upgrade is not feasible, consider temporarily disabling the backchannel.logout.url feature or carefully reviewing and restricting the application.session.host placeholder usage. Implement strict network segmentation to limit the potential impact of successful exploitation. Web Application Firewalls (WAFs) configured to detect and block SSRF attempts can provide an additional layer of defense.