Keycloak Server-Side Request Forgery (SSRF) vulnerability

GHSA-fwhw-chw4-gh37 · CVE-2026-1518

Published Feb 2, 2026 · Modified Feb 3, 2026

Description

A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-1518
WEB https://access.redhat.com/security/cve/CVE-2026-1518
WEB https://bugzilla.redhat.com/show_bug.cgi?id=2433727
PACKAGE https://github.com/keycloak/keycloak

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes