Keycloak’s OpenID Connect Dynamic Client Registration uses private_key_jwt authentication and permits a client to provide an arbitrary jwks_uri. Keycloak blindly follows that URI and retrieves the JWK set, creating a blind server‑side request forgery that can reach internal or restricted endpoints. Attackers can therefore scan a corporate network or cloud metadata services for exposed services, producing information disclosure and reconnaissance data without directly engaging the victim systems.

The vulnerability affects Red Hat Build of Keycloak, particularly versions 26.4 and 26.4.11, as well as the Red Hat build of Keycloak 26.4 prior to the update. It also impacts Red Hat JBoss Enterprise Application Platform 8, the JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. No additional version restrictions are listed in the official CNA data.

With a CVSS score of 5.8, the issue falls into the medium severity range. The EPSS score of less than 1% suggests a low exploitation probability in the current landscape, and it is not present in the CISA KEV catalog. The likely attack vector is an attacker or compromised client that successfully registers with Keycloak using private_key_jwt, enabling it to supply an arbitrary jwks_uri. Because the flaw does not require authentication to the Keycloak server itself, the attacker could leverage legitimate client registration flows or hijacked clients to mitigate the internal‑network probing risk.