PT-2026-28224 · Red Hat · Keycloak

Osidb Bzimport · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-4874

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the client session host parameter during refresh token requests. This is possible when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure. Server-Side Request Forgery (SSRF) is a web security flaw that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker’s choosing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4874

GHSA-22RM-WP4X-V5CX

Affected Products

Keycloak

References · 6

• https://osv.dev/vulnerability/GHSA-22rm-wp4x-v5cx · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-4874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4874 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2451611 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://twitter.com/CVEnew/status/2037137722624627131 · Twitter Post