EUVD-2026-45164
GHSA-rpfh-mgxm-c6hc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
PR:H reflects mandatory delegated admin access; C:H captures full client secret exfiltration; I:L reflects token URL tampering; AV:N because exploitation occurs via the web-based admin interface.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
AnalysisAI
Keycloak's identity provider management component exposes OIDC client secrets to delegated administrators who manipulate the masked sentinel value mechanism during IdP updates. When a delegated admin submits a configuration update using the sentinel placeholder for the client secret while simultaneously changing the token URL to an attacker-controlled endpoint, Keycloak improperly reuses the real underlying secret without validating the consistency of the changed security-sensitive field. On the next authentication flow through that identity provider, Keycloak transmits the real client secret to the attacker's token URL, resulting in credential exfiltration. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerable component is keycloak-services, which manages the lifecycle of OIDC identity providers within Keycloak's federated identity architecture. Keycloak employs a masked sentinel value pattern in its UI and API to avoid round-tripping plaintext secrets - when an admin views or edits an IdP configuration, the actual client_secret is replaced with a placeholder sentinel. The intended behavior is that if the admin submits the sentinel unchanged, the real secret is preserved; if a new secret is provided, it replaces the old one. CWE-1288 (Improper Validation of Consistency within Input) precisely describes the flaw: the system fails to check whether submission of the sentinel alongside a changed token_url creates an inconsistent and insecure state. Specifically, Keycloak reuses the real secret even when the token endpoint URL - the destination to which that secret will be transmitted - has been changed to an untrusted value. Affected CPEs include cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack, and cpe:2.3:a:red_hat:red_hat_data_grid_8.
RemediationAI
Apply the vendor-supplied patch through the Red Hat Customer Portal advisory at https://access.redhat.com/security/cve/CVE-2026-15943; an exact fixed version is not independently confirmed from the available data, so consult that page and the associated Bugzilla ticket at https://bugzilla.redhat.com/show_bug.cgi?id=2501270 for the precise target version. As a compensating control pending patching, revoke or tightly scope delegated administrator roles to limit which accounts can modify identity provider configurations - this directly removes the attack surface since PR:H is required. Audit existing OIDC identity provider token URLs for unexpected changes as an indicator of prior exploitation. If delegated admin access cannot be restricted, consider disabling the ability for delegated admins to modify OIDC token URLs specifically, if Keycloak's fine-grained policy framework permits that scope restriction. Note that removing delegated admin access may disrupt legitimate administrative workflows and should be assessed against operational requirements.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today