An authenticated attacker can abuse a Keycloak flaw that allows manipulation of the client_session_host parameter during refresh token requests. By configuring a client to use a backchannel logout URL that expands a placeholder, the attacker forces the Keycloak server to resolve and request an attacker‑supplied URL, producing a server‑side request forgery. The resulting internal HTTP requests can probe network services or expose sensitive data.

The vulnerability affects Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 8, the JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. Specific version information is not provided, so the flaw likely applies to the current releases referenced in the advisory.

The CVSS score of 3.1 classifies the issue as low severity, and the EPSS score below 1 % indicates a low likelihood of exploitation. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authentication and a client configured with the vulnerable backchannel logout setting; when those conditions are met, the attacker can force requests from the Keycloak server’s internal network, potentially leaking internal information.