Executive brief
A security flaw was found in Keycloak, an open-source identity and access management tool. The issue allows a delegated administrator to trick the system into sending sensitive credentials (client secrets) to a server they control. By modifying specific configuration settings while using a placeholder value for the secret, the administrator can capture the actual secret, potentially leading to unauthorized access to external identity providers.
Technical details
An improper validation vulnerability exists in the IdentityProviderResource.updateIdpFromRep() function of Keycloak. When a delegated administrator with 'manage-identity-providers' permissions updates an OIDC identity provider using the masked client secret sentinel value (ComponentRepresentation.SECRET_VALUE), Keycloak reuses the existing plaintext secret without verifying if other security-sensitive fields have changed. An attacker can exploit this by changing the 'tokenUrl' to a malicious endpoint; Keycloak will then transmit the real secret to the attacker-controlled server during subsequent authentication flows. This bypasses the intended security boundary of secret masking in the administrative API.
Affected products
- Red Hat Red Hat Build of Keycloak All versions using keycloak-services
Timeline
- 2026-07-16: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-17: advisory: NVD publication date