Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security flaw in its administrative interface allows certain low-level administrators to view sensitive client passwords (secrets) that should be protected in a secure vault. If exploited, an authorized user with limited permissions could obtain these credentials to impersonate applications or gain unauthorized access to other parts of the system.
Technical details
An information disclosure vulnerability exists in the Keycloak Admin REST API, specifically within the 'GET /admin/realms/{realm}/clients/{clientUuid}/client-secret/rotated' endpoint. The issue stems from improper boundary enforcement when processing rotated client secrets stored in a secure vault (e.g., using ${vault.rotated-secret} placeholders). Instead of returning the vault placeholder, the API returns the resolved plaintext secret. An attacker must possess the 'realm-management:view-clients' role to exploit this. While the primary client secret remains protected, the exposure of the rotated secret allows for client impersonation and bypasses vault security boundaries.
Affected products
- Red Hat Keycloak unspecified
Timeline
- 2026-07-24: disclosed: Initial vulnerability report and Bugzilla entry created.
- 2026-07-24: advisory: NVD and Red Hat published advisory details.