关键漏洞信息 Bug ID: 2433727 (CVE-2026-1518) 漏洞名称: keycloak: Blind Server-Side Request Forgery (SSRF) via CIBA Backchannel Notification Endpoint in Keycloak 状态: NEW 产品: Security Response 组件: vulnerability 优先级: low 严重性: low 报告时间: 2026-01-28 08:09 UTC 最近修改: 2026-02-02 07:06 UTC 漏洞描述 Blind SSRF behavior in the CIBA implementation of Keycloak. The issue arises because the backchannel_client_notification_endpoint configured during Dynamic Client Registration or client administration is not sufficiently validated before use. An attacker with high privileges (Administrator access or a valid Initial Access Token) can configure this endpoint to point to arbitrary internal URLs, including localhost or cloud metadata services. When a CIBA authentication request is initiated in ping mode, Keycloak sends a blind POST request to the configured endpoint. While the attacker cannot observe the response, the behavior allows limited influence over server-side network interactions and may enable abuse of internal services.