Executive brief
A security flaw in Red Hat Build of Keycloak allows administrative users with limited 'view-only' permissions to see sensitive third-party credentials, such as reCAPTCHA secret keys. These secrets are also recorded in plain text within administrative logs. An attacker with access to these logs or a low-level administrative account could use this information to bypass security measures like bot detection.
Technical details
An information exposure vulnerability exists in the 'keycloak-services' component of Red Hat Build of Keycloak. The flaw is located in the 'ModelToRepresentation.toRepresentation' method, which fails to filter or mask configuration entries marked as secrets in provider metadata when processing requests to the 'GET /admin/realms/{realm}/authentication/config/{id}' endpoint. This allows authenticated users with the 'view-realm' role to retrieve raw secret values, such as reCAPTCHA secret keys. Furthermore, these unmasked secrets are serialized into administrative events, potentially exposing them to any user with log-reading privileges. This exposure can be leveraged to undermine bot-detection mechanisms.
Affected products
- Red Hat Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-17: disclosed: Initial vulnerability report and CVE publication.