AIKIDO-2026-61094
keycloak-services is vulnerable to Information Disclosure
58
Medium Risk
This Affects:
keycloak-servicesTL;DR
The Admin REST endpoint GET /admin/realms/{realm}/clients/{clientUuid}/client-secret/rotated returns the vault-resolved plaintext value when a confidential client's rotated secret is stored as a vault placeholder. A delegated administrator with view-clients can therefore read the usable rotated secret instead of the placeholder string. The fix returns the vault placeholder rather than the resolved secret on that endpoint.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and store rotated client secrets in a vault using placeholder references.
Background info
keycloak-services is vulnerable to Information Disclosure in versions 26.0.0 - 26.7.1.
How to fix this
Upgrade the org.keycloak:keycloak-services library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:56523access.redhat.com/errata/RHSA-2026:56524access.redhat.com/security/cve/CVE-2026-17048bugzilla.redhat.com/show_bug.cgi?id=2506743
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant