CVE-2026-4874 in Keycloak
Summary
by MITRE • 03/26/2026
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/10/2026
The vulnerability identified as CVE-2026-4874 represents a critical server-side request forgery flaw within the Keycloak identity and access management platform. This vulnerability specifically affects environments where Keycloak clients are configured to utilize the backchannel logout functionality with the application.session.host placeholder. The flaw exists in the token refresh mechanism where the `client_session_host` parameter is not properly validated or sanitized, creating an opportunity for authenticated attackers to manipulate the underlying HTTP requests. The vulnerability stems from insufficient input validation and improper handling of user-supplied data within the session management component of Keycloak's authentication framework.
The technical exploitation of this vulnerability occurs when an authenticated attacker crafts a malicious refresh token request that includes a manipulated `client_session_host` parameter. When Keycloak processes this request and encounters the `backchannel.logout.url` configuration with the `application.session.host` placeholder, the system fails to properly validate the host parameter before making outgoing HTTP requests. This allows the attacker to redirect the server's outgoing requests to arbitrary internal network endpoints, effectively enabling network reconnaissance and potential information disclosure attacks. The vulnerability is particularly dangerous because it leverages the trusted network context of the Keycloak server, bypassing typical network segmentation controls and access restrictions.
Operationally, the impact of this vulnerability extends beyond simple information disclosure to encompass potential internal network reconnaissance and service enumeration. An attacker can leverage the compromised server to probe internal APIs, database endpoints, and other network services that would otherwise be inaccessible from external network positions. The vulnerability creates a persistent threat vector that can be exploited repeatedly, as long as the attacker maintains valid authentication credentials within the Keycloak environment. This risk is compounded by the fact that Keycloak servers often run in privileged network positions with access to sensitive internal resources, making the potential attack surface particularly valuable for threat actors seeking to escalate their access within the target environment.
Organizations should implement immediate mitigations including strict input validation for all session-related parameters and the removal of the vulnerable backchannel logout configurations where possible. The implementation of network segmentation controls and outbound traffic filtering can help limit the potential impact of successful exploitation attempts. Security teams should also consider implementing monitoring solutions that can detect anomalous outgoing HTTP requests originating from Keycloak servers, as these patterns may indicate exploitation attempts. This vulnerability aligns with CWE-918, which specifically addresses server-side request forgery vulnerabilities, and maps to ATT&CK technique T1046 for network service scanning and T1071 for application layer protocols. Organizations should prioritize patching and configuration hardening while maintaining continuous monitoring to detect potential exploitation attempts.