EUVD-2026-95033
GHSA-ch4r-x5r9-rqr3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Requires an authenticated admin with only the limited read-only view-clients role, so PR:L rather than PR:H; network-reachable endpoint with low complexity, confidentiality-only impact (secret disclosure).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This exposed secret can be used to impersonate the client and gain unauthorized access to its associated service account permissions.
AnalysisAI
Keycloak, including the Red Hat Build of Keycloak and Red Hat Single Sign-On 7, exposes the active primary secret of confidential clients to any authenticated realm administrator who holds only the read-only view-clients role. The flaw sits in the installation provider and client registration endpoints, which return client credentials that a read-only administrator should never be able to read; with the leaked secret an attacker can authenticate as the confidential client and inherit its service account permissions across integrated services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Keycloak/RHSSO realm administrator account holding the read-only view-clients role; the attacker then accesses the installation provider or client registration endpoints to read the active primary secret of a confidential client. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, access-gated information-disclosure flaw (CWE-200) rather than a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available intelligence, so administrators should treat the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-107604 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2547941 as the authoritative source and apply the fixed build as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today