Executive brief
Defense Unicorns UDS Identity Config, a component used to manage identity and access in UDS Core deployments, contains a critical authentication bypass. An attacker can impersonate system services and obtain administrative access tokens without providing a valid password or secret. This could allow an unauthorized user to modify security settings, create new accounts, or tamper with other applications within the environment.
Technical details
A logic error exists in the `client-kubernetes-secret` Keycloak client authenticator where the user-provided `client_secret` is overwritten by the expected secret from the Kubernetes environment before the comparison occurs. This results in a successful match regardless of the input provided by the attacker. An unauthenticated attacker with network access to the Keycloak token endpoint can exploit this by providing a known `client_id` and any arbitrary string as the `client_secret`. Successful exploitation grants an OAuth2 access token with the privileges of the targeted client; specifically, targeting the `uds-operator` client allows for the registration and modification of other OIDC clients. The issue is fixed in UDS Identity Config version 0.26.1 and UDS Core versions 1.0.1, 1.1.1, and 1.2.2.
Affected products
- Defense Unicorns uds-identity-config 0.11.0 - 0.26.0
- Defense Unicorns uds-core 0.39.0 - 1.2.1
Timeline
- 2026-04-27: patched: Version 0.26.1 released
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-05: disclosed: CVE-2026-46389 published to NVD