CVE-2026-89298: Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get
A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive information, the service returns the client's confidential secret in cleartext. This could allow a read-only administrator to obtain full access to the affected client's account and potentially escalate their privileges within the realm.
Other sources
A flaw was found in the org.keycloak.services.clientregistration Java package in Keycloak. The Dynamic Client Registration GET endpoint at /realms/{realm}/clients-registrations/default/{clientId} fails to mask the client secret in its response. While a similar issue was previously fixed for the Admin REST API, this specific endpoint was overlooked. An authenticated attacker with the view-clients role can exploit this to retrieve the cleartext secret of any confidential client in the realm. With this secret, the attacker can perform actions such as obtaining access tokens via the client credentials grant, potentially leading to full realm compromise if the client's service account has elevated permissions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to retrieve a client secret?
The attacker must be authenticated in the target realm and have the view-clients role. No user interaction is required.
Which client secrets can be exposed?
A user with the view-clients role can retrieve the cleartext secret of any confidential client in the realm through the Dynamic Client Registration GET endpoint.
What can an attacker do with an exposed confidential client secret?
The secret can be used to obtain access tokens through the client credentials grant. Depending on the affected client's permissions, this may enable privilege escalation and potentially compromise the realm.