CVE-2026-4874

Description

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.

CVSS breakdown

Affected products

• RedHat / build_of_keycloak
• RedHat / jboss_enterprise_application_platform8.0.0 – 8.0.0
• RedHat / jboss_enterprise_application_platform_expansion_pack
• RedHat / single_sign-on7.0 – 7.0

References

• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:25097
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:25098
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:30049
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:30050
• VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-4874
• MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2451611