VULNERABILITY INTELLIGENCE

CVE-2026-15943

CVSS score5.5 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-07-17
Last modified2026-08-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Description

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.

Weakness classification

  • CWE-1288: Improper Validation of Consistency within Input

Primary references