CVE-2026-4874: Keycloak SSRF via OIDC token endpoint manipulation

CVE-2026-4874 · Severity: low · CVSS 3.1 · Published 2026-03-26

Keycloak, a popular open-source identity and access management solution, is affected by a security flaw that could allow an authenticated user to perform unauthorized network requests. By manipulating specific session parameters, an attacker can force the Keycloak server to connect to internal systems or APIs that are not normally accessible from the outside. This could lead to the exposure of sensitive internal information or help an attacker map out a company's private network.

Technologies: Keycloak, org.keycloak:keycloak-services (Maven), Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack, Redhat Single Sign-On. Vendors: Keycloak, Maven, Redhat.

Quick answers

Is CVE-2026-4874 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4874 being exploited in the wild.
How severe is CVE-2026-4874?
Low severity, with a CVSS score of 3.1, published 26 March 2026.
Which products and versions are affected?
Keycloak <= 26.6.0, >= 26.5.0, < 26.6.3; org.keycloak:keycloak-services (Maven) <= 26.6.0, ECOSYSTEM:introduced=26.5.0,fixed=26.6.3.
Is there a fix for CVE-2026-4874?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4874 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-4874?
Check whether you run Keycloak, org.keycloak:keycloak-services (Maven), Redhat Jboss Enterprise Application Platform or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.3 or later
    # set org.keycloak:keycloak-services to 26.6.3 in your pom.xml or build.gradle

Technical details

A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in Keycloak's OIDC token endpoint. An authenticated attacker can exploit this by manipulating the 'client_session_host' parameter during refresh token requests. The vulnerability is triggered when a Keycloak client is configured to use the 'backchannel.logout.url' containing the 'application.session.host' placeholder. By supplying a malicious host value, the attacker forces the Keycloak server to initiate HTTP requests from its own network context. This can be used to probe internal network services or APIs that are otherwise unreachable. The issue is patched in versions 26.6.3 and 26.4.13.

Affected products

  • Keycloak Keycloak >= 26.5.0, < 26.6.3
  • Keycloak Keycloak < 26.4.13

Identifiers

  • CVE-2026-4874
  • GHSA-22rm-wp4x-v5cx

Timeline

  • 2026-03-26: advisory: Initial publication of GHSA-22rm-wp4x-v5cx
  • 2026-03-26: disclosed: NVD publication date
  • 2026-07-15: other: Last updated date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.