Source: https://issues.redhat.com/browse/RHBK-4109

Security Tracking Issue

Flaw:

Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri

Blind Server-Side Request Forgery (SSRF) vulnerability in the Keycloak OIDC Dynamic Client Registration flow when using private_key_jwt client authentication. The flaw is caused by the absence of validation or restriction on the jwks_uri parameter supplied during client registration. When validating a client’s JWT assertion, Keycloak automatically fetches the JWKS from the attacker-controlled URI using server-side HTTP requests. This allows remote attackers to force the Keycloak server to access internal network resources such as localhost services, RFC1918 addresses, or cloud metadata endpoints. Although responses are not directly returned, attackers can infer reachable services via timing and error behavior, enabling internal network enumeration without authentication in configurations that permit anonymous or token-based client registration.

This issue was originally tracked in the private repository as #322. Migrated via lift-embargo process.