Vulnerability · Published Jul 17, 2026 · Assigned by redhat

CVE-2026-15943Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

Medium 5.5

In plain English

A medium-severity security flaw in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Data Grid 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	see references
Red Hat	Red Hat Single Sign-On 7	see references

Weakness: CWE-1288 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-15943 vdb-entry, x_refsource_REDHAT
RHBZ#2501270 issue-tracking, x_refsource_REDHAT