Description
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
Metrics
CVSS 3.1 5.5/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.6 | — |
| Red Hat | Red Hat build of Keycloak 26.6 | — |
| Red Hat | Red Hat build of Keycloak 26.6 | — |
| Red Hat | Red Hat build of Keycloak 26.6.8 | — |
| Red Hat | Red Hat build of Keycloak 26.6.8 | — |
| Red Hat | Red Hat build of Keycloak 26.6.8 | — |
| Red Hat | Red Hat Data Grid 8 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — |
| Red Hat | Red Hat Single Sign-On 7 | — |
References
Timeline
- Published
- Jul 17, 2026
- Last modified
- Nov 6, 2026
- NVD status
- Modified