Vulnerability Details CVE-2026-4874
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 7.9%
CVSS Severity
CVSS v3 Score 3.1
References
Products affected by CVE-2026-4874
-
cpe:2.3:a:redhat:build_of_keycloak:-
-
cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0
-
cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-
-
cpe:2.3:a:redhat:single_sign-on:7.0