Red Hat Keycloak CVE-2026-15943

Exploitation requires the attacker to hold a Keycloak delegated administrator role with permissions to update identity provider configurations - specifically the 'manage-identity-providers' permission or equivalent delegation. An OIDC identity provider must already be configured in the Keycloak realm. The attack does not require any end-user interaction and is conducted entirely through Keycloak's administrative API or UI. The critical limiting factor is the PR:H prerequisite: only accounts with delegated admin privileges over identity provider management can execute this attack, substantially narrowing the realistic threat actor population to malicious insiders, compromised admin accounts, or attackers who have achieved prior elevation to delegated admin within the Keycloak realm. Default Keycloak deployments without delegated administration or without configured OIDC identity providers are not exploitable via this path.

The CVSS 3.1 base score of 5.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N reflects a moderate overall risk significantly constrained by the PR:H prerequisite - exploitation is limited to actors who already hold delegated administrator privileges within Keycloak. The C:H impact rating is meaningful: OIDC client secrets are long-lived, reusable credentials that enable impersonation of the Keycloak instance toward external identity providers, making their exfiltration a serious event. The I:L rating reflects the attacker's ability to redirect the token URL. No EPSS data was provided in the intelligence feed, and this CVE is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No POC code is referenced. The real-world priority is medium for organizations using Keycloak with delegated administration enabled: the attack surface is narrow (only delegated admins), but the blast radius of a compromised IdP client secret - potentially enabling downstream authentication bypass against federated systems - is disproportionately large relative to the CVSS score alone. Organizations without delegated admin roles configured face negligible risk from this specific path.

An attacker who holds or has compromised a delegated administrator account in Keycloak navigates to an existing OIDC identity provider configuration and changes the token endpoint URL to an attacker-controlled server while submitting the masked sentinel placeholder in the client_secret field. Keycloak, failing to detect the inconsistency between the sentinel and the changed token URL, saves the configuration with the real client secret intact. On the next user authentication attempt through that identity provider, Keycloak sends an OAuth token exchange request - including the real client_secret - to the attacker's server, which logs and captures the credential for subsequent abuse.