Red Hat Build of Keycloak CVE-2026-16104

Exploitation requires an authenticated Keycloak administrative session with at least view-only realm-admin permissions (PR:L per CVSS vector). The vulnerability is specific to the authentication configuration endpoint within keycloak-services and is only reachable if third-party service credentials (such as reCAPTCHA secret keys) have been configured in the Keycloak authentication flow. Exploitation is limited to users who already hold a valid Keycloak administrative account - anonymous or non-administrative authenticated users cannot reach this endpoint. The exposure is compounded in environments where administrative audit logs capture full API response bodies, as the credentials may appear in log storage accessible to log-pipeline operators beyond just the direct API caller. There is no requirement for a special non-default configuration beyond having external service credentials (e.g., reCAPTCHA) populated in the authentication configuration.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) scores 4.3 Medium, accurately reflecting that exploitation requires low-privilege authenticated access and produces only limited confidentiality impact per the scoring rubric. However, the practical risk warrants careful consideration: the exposed values are functional third-party API secrets (e.g., reCAPTCHA secret keys) which, once exfiltrated, can be used to abuse external services entirely outside Keycloak's control plane - an indirect integrity and availability impact not captured by the base CVSS score. The key limiting factor is the PR:L requirement: an attacker must already hold a Keycloak administrative account with at least view-only realm access, which represents a meaningful barrier in well-governed environments. No EPSS score was provided in the source data, and the absence of KEV listing and any public POC suggests this is not being exploited opportunistically at scale. The most realistic threat model is an insider threat or a compromised view-only admin account being used to harvest credentials for downstream service abuse. Organizations with strict separation between view-only and configuration-change admin roles, or those that have configured reCAPTCHA and similar integrations, should treat this as a priority rotation and access-review item despite the moderate CVSS score.

An attacker who has obtained or been legitimately granted a Keycloak administrative account with view-only realm permissions - via phishing, credential stuffing, or insider access - sends an authenticated GET request to the authentication configuration endpoint in the Keycloak admin API. The response returns the full configuration blob including the reCAPTCHA secret key in plaintext. The attacker then uses those credentials to interact with the Google reCAPTCHA API or other configured third-party services, bypassing CAPTCHA protections on any application relying on that key. No public POC code has been identified at time of analysis.