EUVD-2026-45226
GHSA-qh48-wwv4-fmr8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible admin API requires low-privilege admin auth (PR:L); only specific credential values exposed, so C:L; no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.
AnalysisAI
Sensitive credential exposure in the keycloak-services authentication configuration endpoint allows view-only administrators to retrieve unmasked third-party service secrets, such as reCAPTCHA secret keys, through the administrative API. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and the JBoss EAP Expansion Pack. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the confidential nature of the exposed values - functional API credentials for third-party services - elevates the practical impact beyond what the CVSS score of 4.3 might initially suggest.
Technical ContextAI
The affected component is keycloak-services, the core processing engine within Red Hat Build of Keycloak, which handles identity provider configuration, authentication flows, and integration with external services such as Google reCAPTCHA. When an administrator requests the authentication configuration via the administrative endpoint, the system returns configuration blobs containing sensitive fields (e.g., reCAPTCHA secret keys) in plaintext rather than masking or redacting them. The root-cause class is improper output neutralization or sensitive data exposure - functionally similar to CWE-312 (Cleartext Storage of Sensitive Information) or CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), though the NVD has not assigned a CWE for this entry. The CPE strings confirm impact across cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_data_grid_8, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack, all of which share the affected keycloak-services dependency.
RemediationAI
The primary remediation is to apply the vendor-released patch once available via the Red Hat Customer Portal at https://access.redhat.com/security/cve/CVE-2026-16104; no specific fixed version number is confirmed in the available data at the time of this analysis. As an immediate compensating control, administrators should audit and minimize the number of accounts holding view-only realm-admin permissions in Keycloak, removing access for any accounts that do not require it - reducing the set of principals that could exploit this endpoint. All third-party service credentials currently configured in Keycloak authentication flows (including reCAPTCHA secret keys and any similar API secrets) should be rotated immediately and treated as potentially compromised if view-only admin accounts have accessed the configuration endpoint. If administrative audit logging captures API responses, logs should be reviewed and scrubbed for plaintext credential values. Organizations unable to patch promptly should restrict Keycloak administrative console access to trusted internal network segments using network ACLs, accepting the trade-off of reduced administrative flexibility for external operators.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today