GitHub Advisoryadvisory · Maven

GHSA-fwhw-chw4-gh37 Keycloak Server-Side Request Forgery (SSRF) vulnerability

LOW Published 2026-02-02 Modified 2026-02-02 Official page ↗

Aliases: CVE-2026-1518
Ecosystem: Maven
Packages: org.keycloak:keycloak-parent
Severity: Low
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weaknesses: CWE-918
Reviewed: 2026-02-02

Affected packages

• Maven org.keycloak:keycloak-parent: <= 26.5.2 (no fix yet)

Description

A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.

Alias · not in database (1)

CVE-2026-1518

Weakness · CWE (1)

CWE-918 Server-Side Request Forgery weakness

References