Is CVE-2026-15943 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15943 being exploited in the wild.

How severe is CVE-2026-15943?

Medium severity, with a CVSS score of 5.5, published 17 July 2026.

Which products and versions are affected?

Red Hat build of Keycloak All versions using keycloak-services.

Is there a fix for CVE-2026-15943?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15943 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15943?

Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15943: Keycloak improper validation of OIDC secret masking in keycloak-services

CVE-2026-15943 · Severity: medium · CVSS 5.5 · Published 2026-07-17

A security flaw was found in Keycloak, an open-source identity and access management tool. The issue allows a delegated administrator to trick the system into sending sensitive credentials (client secrets) to a server they control. By modifying specific configuration settings while using a placeholder value for the secret, the administrator can capture the actual secret, potentially leading to unauthorized access to external identity providers.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-15943 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15943 being exploited in the wild.
How severe is CVE-2026-15943?: Medium severity, with a CVSS score of 5.5, published 17 July 2026.
Which products and versions are affected?: Red Hat build of Keycloak All versions using keycloak-services.
Is there a fix for CVE-2026-15943?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15943 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15943?: Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper validation vulnerability exists in the IdentityProviderResource.updateIdpFromRep() function of Keycloak. When a delegated administrator with 'manage-identity-providers' permissions updates an OIDC identity provider using the masked client secret sentinel value (ComponentRepresentation.SECRET_VALUE), Keycloak reuses the existing plaintext secret without verifying if other security-sensitive fields have changed. An attacker can exploit this by changing the 'tokenUrl' to a malicious endpoint; Keycloak will then transmit the real secret to the attacker-controlled server during subsequent authentication flows. This bypasses the intended security boundary of secret masking in the administrative API.

Affected products

Red Hat Red Hat Build of Keycloak All versions using keycloak-services

Timeline

2026-07-16: disclosed: Initial report in Red Hat Bugzilla
2026-07-17: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.