Keycloak Lets a Delegated Admin Move the Token URL Without Re-Entering the Secret. The Stored Secret Follows.
Photo: Forkast
A flaw in Keycloak’s IdentityProviderResource component allows for the inadvertent reuse of masked client secrets during OIDC configuration updates, creating a path for credential interception. Disclosed on October 13, 2026, CVE-2026-15943 represents a failure in the secret-masking boundary within the Keycloak IdentityProviderResource. The vulnerability centers on how the system handles masked sentinel values-typically represented as a string of asterisks-when an administrator modifies an existing OpenID Connect (OIDC) Identity Provider (IdP) configuration. Under normal operation, the masking mechanism is intended to prevent the exposure of sensitive credentials in the UI.
Source: Forkast
