CVE-2026-15943 : A vulnerability was identified in Keycloak's admin API where the secret masking boundary is bypassed for OIDC identity-provider client secrets. The flaw exists in the IdentityProviderResource.updateIdpFromRep() function. When a PUT request is made to update an IdP configuration and the clientSecret is set to the masked sentinel value (ComponentRepresentation.SECRET_VALUE), Keycloak unconditionally copies the actual stored secret into the update. The root cause is a lack of validation to check if security-sensitive destination fields—specifically tokenUrl, clientId, or clientAuthMethod—have been modified in the same request. A delegated IdP manager with manage-identity-providers permissions can exploit this by changing the tokenUrl to an attacker-controlled endpoint while providing the masked secret sentinel. Keycloak will then bind the real secret to the new, malicious endpoint, allowing the attacker to capture the secret through normal broker traffic.(update with upstream content)
This issue was originally tracked in the private repository. Migrated by @ahus1 .
ahus1 added priority/important Must be worked on very soon Must be worked on very soon area/identity-brokering Identity brokering — external IdPs (social, OIDC, SAML), account linking Identity brokering — external IdPs (social, OIDC, SAML), account linking kind/cve Issues identified as CVEs on third-party dependencies, or issues which Keycloak is not affected Issues identified as CVEs on third-party dependencies, or issues which Keycloak is not affected team/core-iam backport/26.6 on Jul 16, 2026
ahus1 added the cve issue type on Jul 16, 2026
stianst added this to Keycloak Roadmap on Sep 10, 2026
github-project-automation moved this to Backlog in Keycloak Roadmap on Sep 10, 2026
abstractj added severity/medium 50 calendar days to fix 50 calendar days to fix on Sep 30, 2026
ahus1 added backport/26.8 on Oct 1, 2026
edewit self-assigned this on Oct 1, 2026
pedroigor added a commit that references this issue on Oct 8, 2026 fixes CVE-2026-15943 by dropping when other values are changed This issue will close once commit 2ec0b6d is merged into the 'main' branch. 2ec0b6d
fixes CVE-2026-15943 by dropping when other values are changed
pedroigor closed this as completed in #53411 on Oct 9, 2026
github-project-automation moved this from Open to Done in Keycloak Roadmap on Oct 9, 2026
github-actions added release/27.0.0 on Oct 9, 2026
msdaly200 added a commit that references this issue on Oct 9, 2026 fixes CVE-2026-15943 by dropping when other values are changed ( keycl… This issue will close once commit 17e1425 is merged into the 'main' branch. 17e1425
fixes CVE-2026-15943 by dropping when other values are changed ( keycl…
PadzerButch added a commit that references this issue on Oct 9, 2026 fixes CVE-2026-15943 by dropping when other values are changed ( keycl… This issue will close once commit a1b1ebc is merged into the 'main' branch. a1b1ebc
fixes CVE-2026-15943 by dropping when other values are changed ( keycl…
vmuzikar added a commit that references this issue on Oct 9, 2026 fixes CVE-2026-15943 by dropping when other values are changed ( #53411 )… This issue will close once commit 8f29692 is merged into the 'main' branch. 8f29692
fixes CVE-2026-15943 by dropping when other values are changed ( #53411 )…
github-actions added release/26.8.1 and removed backport/26.8 on Oct 9, 2026
pedroigor added a commit that references this issue on Oct 9, 2026 fixes CVE-2026-15943 by dropping when other values are changed ( #53411 ) This issue will close once commit b61694a is merged into the 'main' branch. b61694a
fixes CVE-2026-15943 by dropping when other values are changed ( #53411 )
github-actions added release/26.6.8 and removed backport/26.6 on Oct 9, 2026
Keycloak Roadmap Status Done Show more project fields
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
