Description
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | keycloak 13.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 9.0.11-1.redhat_00001.1.el6sso | RHSA-2021:0320, RHSA-2021:0319, RHSA-2021:0318 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated) EDB-50405 · webapps · Oct 13, 2021
GitHub 2 repositories
-
ColdFusionX/Keycloak-12.0.1-CVE-2020-10770 ★ 9 · Oct 13, 2021
Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)
-
0xlyvio/CVE-2020-10770-keycloak-exploit-poc ★ 2 · Sep 5, 2026
Keycloak Blind SSRF POC
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF) http/cves/2020/CVE-2020-10770.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-core | < 13.0.0 | 13.0.0 | GHSA-jh7q-5mwf-qvhw |
Advisories 3
- RHSA-2021:0319 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.5 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0320 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.5 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2021:0318 Red Hat Security Advisory: Red Hat Single Sign-On 7.4.5 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Jun 29, 2026