EUVD-2026-76104
GHSA-386r-m7rr-67p4
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Requires view-clients admin role assignment (PR:H); endpoint is network-accessible (AV:N); only client secret confidentiality is impacted, no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive information, the service returns the client's confidential secret in cleartext. This could allow a read-only administrator to obtain full access to the affected client's account and potentially escalate their privileges within the realm.
AnalysisAI
Keycloak's Dynamic Client Registration endpoint exposes confidential client secrets in cleartext to users holding the view-clients realm management role, violating the principle of least privilege. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all tracked versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker possess a valid Keycloak account that has been explicitly granted the view-clients realm management role - this role is not assigned by default to end users or even to all administrators, and must be deliberately delegated by a realm admin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.9 medium score is justified at the raw metric level - PR:H requires the attacker to already hold a specific administrative role - but the practical business impact is meaningfully higher than the numeric score suggests because the compromised credential enables secondary privilege escalation: a view-clients user who obtains a client_secret can impersonate any confidential client in the realm, potentially gaining access to protected resource servers, user data, or other admin-adjacent APIs depending on how clients are scoped. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-89298 and the associated Bugzilla ticket at https://bugzilla.redhat.com/show_bug.cgi?id=2531871 for patch availability and exact fixed versions - no specific patched version was provided in the available intelligence data, so a vendor-confirmed fix version is not independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today