CVE detail
CVE-2026-4874
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- https://bugzilla.redhat.com/show_bug.cgi?id=2451611bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMar 26, 2026, 8:16 AM - https://access.redhat.com/security/cve/CVE-2026-4874access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 AM - https://access.redhat.com/errata/RHSA-2026:30050access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 AM - https://access.redhat.com/errata/RHSA-2026:30049access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 AM - https://access.redhat.com/errata/RHSA-2026:25098access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 AM - https://access.redhat.com/errata/RHSA-2026:25097access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 26, 2026, 8:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-4366CVSS 5.8 · Medium
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. Th…
- CVE-2026-3121CVSS 6.5 · Medium
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This al…
- CVE-2026-3009CVSS 8.1 · High
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by…
- CVE-2022-4492CVSS 7.5 · High
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by def…
- CVE-2026-28369CVSS 8.7 · High
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping…
- CVE-2026-28368CVSS 8.7 · High
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to…