CVE-2026-4874

LowCVSS 3.1/10Last modified Jun 26, 2026

Description

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Mar 26, 2026
Last modified: Jun 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-487417.5libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. P CVE-2026-487437.5Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy c CVE-2026-487446.5Saleor is an e-commerce platform. From 3.14.67 until 3.21.67, 3.22.63, and 3.23.22, a broken authorization check in saleor/permission/utils.CVE-2026-487459.3Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versi CVE-2026-487469.1vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and s CVE-2026-487475.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatReques CVE-2026-487487.5Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to versi CVE-2026-487499.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/wri CVE-2026-48754.7A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /a CVE-2026-487509.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec CVE-2026-487519.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlev CVE-2026-487529.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to