REDHAT-BUG-2547941: Medium severity Red Hat Keycloak vulnerability
A flaw was found in the Admin REST installation provider endpoints and the Client Registration install endpoint in Keycloak. While the dedicated client-secret endpoint correctly enforces authorization, these specific endpoints fail to mask the client secret when accessed by a user with the realm-management:view-clients role. An authenticated attacker with this role can retrieve the cleartext secret of any confidential client using the client-secret authenticator. Successful exploitation allows the attacker to obtain a client-credentials access token and exercise the target client's service account permissions. This issue represents an incomplete fix for CVE-2026-89298.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the realm-management:view-clients role. They can then retrieve the cleartext secret for any confidential client that uses the client-secret authenticator.
What can an attacker do with a recovered client secret?
The attacker can obtain a client-credentials access token for the affected client. That token can be used to exercise the permissions assigned to the target client's service account.
Which interfaces expose the secret?
The affected interfaces are the Admin REST installation provider endpoints and the Client Registration install endpoint. The dedicated client-secret endpoint correctly enforces authorization.
How can I determine whether credentials may have been exposed?
Review access to the affected installation and client-registration install endpoints by users holding the realm-management:view-clients role, especially where confidential clients use the client-secret authenticator. The provided information does not identify logging indicators or a method to confirm past secret retrieval.