Insufficient validation of client‑configured backchannel notification endpoints in Keycloak’s CIBA feature allows an attacker to cause the server to make blind HTTP requests to internal services. Because the responses are not returned to the attacker, the vulnerability is a blind server‑side request forgery (SSRF) that can expose internal network endpoints or serve as a foothold for further exploitation, compromising the confidentiality and integrity of internal infrastructure.

Red Hat Build of Keycloak is affected. No specific version information is available in the advisory.

The CVSS score of 2.7 indicates low overall risk, and the EPSS score of <1% shows very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attacks would target the backchannel_client_notification_endpoint, generating outbound requests from the Keycloak server to any URL supplied by a client, potentially reaching internal services that are otherwise inaccessible.