Moole Vulnerability Database

Find real vulnerabilities before they ship

Low

CVE-2026-1518

A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.

VectorNETWORK

PublishedFeb 02, 2026, 08:16

Published Bysecalert@redhat.com

Base Score

Score2.7

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.keycloak:keycloak-parent(Maven)0N/AN/A

References

https://access.redhat.com/security/cve/CVE-2026-1518
https://bugzilla.redhat.com/show_bug.cgi?id=2433727

Weakness Type

CWE-918

CVSS Metrics

Base Score

2.7

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Base SeverityLow

Version

3.1

Attack Vector (AV)

NETWORK