Blind SSRF via unvalidated CIBA notification endpoint

SSRF in the CIBA feature of Red Hat build of Keycloak allows remote authenticated users to send blind POST requests to internal services. The server accepts a backchannel_client_notification_endpoint configured through Dynamic Client Registration or client administration without sufficiently validating its destination, then posts to it when a CIBA request runs in ping mode. Administrative access or a valid Initial Access Token is required, and response content remains hidden while internal services receive attacker-selected requests.