CVE-2026-15943: Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

A vulnerability was identified in Keycloak's admin API where the secret masking boundary is bypassed for OIDC identity-provider client secrets. The flaw exists in the IdentityProviderResource.updateIdpFromRep() function. When a PUT request is made to update an IdP configuration and the clientSecret is set to the masked sentinel value (ComponentRepresentation.SECRETVALUE), Keycloak unconditionally copies the actual stored secret into the update. The root cause is a lack of validation to check if security-sensitive destination fields—specifically tokenUrl, clientId, or clientAuthMethod}}—have been modified in the same request. A delegated IdP manager with {{manage-identity-providers permissions can exploit this by changing the tokenUrl to an attacker-controlled endpoint while providing the masked secret sentinel. Keycloak will then bind the real secret to the new, malicious endpoint, allowing the attacker to capture the secret through normal broker traffic.

— Red Hat