REDHAT-BUG-2531871: Medium severity Keycloak org.keycloak.services.clientregistration vulnerability
A flaw was found in the org.keycloak.services.clientregistration Java package in Keycloak. The Dynamic Client Registration GET endpoint at /realms/{realm}/clients-registrations/default/{clientId} fails to mask the client secret in its response. While a similar issue was previously fixed for the Admin REST API, this specific endpoint was overlooked. An authenticated attacker with the view-clients role can exploit this to retrieve the cleartext secret of any confidential client in the realm. With this secret, the attacker can perform actions such as obtaining access tokens via the client credentials grant, potentially leading to full realm compromise if the client's service account has elevated permissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user or attacker with the view-clients role in a realm can exploit the affected Dynamic Client Registration GET endpoint. The issue applies to confidential clients in that realm.
What does an attacker need to do to obtain a client secret?
The attacker needs to call the Dynamic Client Registration GET endpoint at /realms/{realm}/clients-registrations/default/{clientId} for a confidential client. The endpoint returns the client secret in cleartext instead of masking it.
What is the likely impact after a secret is disclosed?
The disclosed secret can be used to obtain access tokens through the client credentials grant. Impact can extend to full realm compromise when the affected client's service account has elevated permissions.