CVE-2026-1180

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The issue allows a client to specify an arbitrary jwks_uri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the Keycloak server into making HTTP requests to internal or restricted network resources. As a result, attackers can probe internal services and cloud metadata endpoints, creating an information disclosure and reconnaissance risk.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4—
Red HatRed Hat build of Keycloak 26.4.11—
Red HatRed Hat Build of Keycloak—
Red HatRed Hat Build of Keycloak—
Red HatRed Hat JBoss Enterprise Application Platform 8—
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack—
Red HatRed Hat Single Sign-On 7—

References

Timeline

Published
Jan 20, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-118008.1A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid cCVE-2026-1180008.1Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, aCVE-2026-1180028.1Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, ThCVE-2026-1180038.1Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, anCVE-2026-1180048.1Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.CVE-2026-1180058.8Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180068.8Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 1CVE-2026-1180078.8Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and ThunderCVE-2026-1180088.8Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180098.8Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-118017.5The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. TCVE-2026-1180108.8Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-1180: Medium severity, CVSS 5.8 | Vulnix