CVE-2026-1180: Keycloak Adapter Core SSRF Vulnerability in OpenID Connect Dynamic Client Registration
Summary
CVE-2026-1180: A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. Affects org.keycloak:keycloak-adapter-core versions < 25.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications. The Keycloak Adapter Core is a library that enables applications to integrate with Keycloak for secure access management. This package supports various authentication protocols, including OpenID Connect. However, a vulnerability has been identified in its OpenID Connect Dynamic Client Registration feature, which can be exploited if not addressed.
Vulnerability Detail
A flaw exists in Keycloak's OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. This vulnerability allows a client to specify an arbitrary jwks_uri, which Keycloak retrieves without validating the destination. Consequently, attackers can manipulate the Keycloak server into making HTTP requests to internal or restricted network resources. This creates a risk of information disclosure and reconnaissance, as attackers can probe internal services and access sensitive cloud metadata endpoints.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict the ability of clients to specify arbitrary jwks_uri values by implementing strict validation on the input parameters before processing the registration request. This can help mitigate the risk until a patch is applied.
Conclusion
The vulnerability identified as CVE-2026-1180 in Keycloak's OpenID Connect Dynamic Client Registration feature poses a moderate risk due to its potential for SSRF attacks. It is crucial for users of the Keycloak Adapter Core to update to the patched version 25.0.4 to mitigate this risk. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for org.keycloak:keycloak-adapter-core →
FAQ
The CVSS score of this vulnerability is 5.8, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The potential impacts include unauthorized access to internal services and sensitive information disclosure, as attackers can exploit the SSRF to probe internal network resources.
Yes, a patch is available in version 25.0.4 of the Keycloak Adapter Core package. It is recommended to update to this version.
If you cannot update the package immediately, implement strict validation on the jwks_uri input to prevent clients from specifying arbitrary values, as a temporary workaround.
