CVE-2026-15943 — Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC…
Published: 2026-07-17 · CVSS: 5.5 · CVSS 3.1
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7