Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Jboss EAP Server-Side Request Forgery (SSRF) Vulnerability - CVE-2026-4874 - Vulnerability Database
Jboss EAP

Jboss EAP Server-Side Request Forgery (SSRF) Vulnerability - CVE-2026-4874

Low
Reference: CVE-2026-4874
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-4874
Title: Jboss EAP Server-Side Request Forgery (SSRF) Vulnerability
Overview:

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the client_session_host parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak servers network context potentially probing internal networks or internal APIs leading to information disclosure.