Skip to main content

Server-Side Request Forgery (SSRF)

CVE-2026-1180

Medium
5.8/10

Summary

A flaw was identified in Keycloaks OpenID Connect Dynamic Client Registration feature when clients authenticate using "private_key_jwt". The issue allows a client to specify an arbitrary "jwks_uri", which Keycloak then retrieves without validating the destination. This enables attackers to coerce the Keycloak server into making HTTP requests to internal or restricted network resources. As a result, attackers can probe internal services and cloud metadata endpoints, creating an information disclosure and reconnaissance risk.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published