CVE-2026-15943 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

Description

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.

Exploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

Low

Privileges required

High

Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected products and versions