CVE-2020-10770

CVE-2020-10770 describes a Server-Side Request Forgery (SSRF) vulnerability in Keycloak versions prior to 13.0.0, specifically impacting Red Hat Keycloak. This flaw allows an unauthenticated attacker to force the Keycloak server to make requests to arbitrary, unverified URLs by manipulating the OIDC parameter request_uri. The vulnerability has a CVSS score of 5.3 (Medium) with a network attack vector and low attack complexity, potentially leading to information disclosure (low impact on confidentiality) but no integrity or availability impact. While not listed on the CISA KEV catalog and with no active exploitation observed, public exploit code exists, including a Metasploit module and Nuclei templates, indicating a high potential for exploitation.