CVE-2026-15943: Keycloak Auth Bypass Vulnerability

CVE-2026-15943 Overview

CVE-2026-15943 affects the keycloak-services component in Keycloak, which manages identity provider configurations. A delegated administrator can update an OpenID Connect (OIDC) identity provider using a masked client secret sentinel value. Keycloak fails to validate whether other sensitive fields have changed. As a result, it reuses the existing real client secret even when the token URL is modified. An attacker with delegated administrator privileges can redirect token requests to an attacker-controlled endpoint and capture the real client secret. The flaw is categorized under [CWE-1288] Improper Validation of Consistency within Input.

Critical Impact
A delegated administrator can exfiltrate the real OIDC client secret by pointing the token URL to an attacker-controlled server while submitting a masked secret sentinel value.

Affected Products

Red Hat Keycloak (keycloak-services component)
Red Hat Single Sign-On distributions built on Keycloak
Downstream identity platforms embedding the affected Keycloak services module

Discovery Timeline

2026-07-17 - CVE CVE-2026-15943 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-15943

Vulnerability Analysis

Keycloak masks stored client secrets in the administrative interface using a sentinel placeholder value. When an administrator submits an identity provider update, the server checks whether the submitted secret equals the mask. If it does, Keycloak preserves the previously stored real secret. This design assumes the rest of the configuration remains trustworthy.

The keycloak-services component does not re-validate the integrity of related security-sensitive fields during the update. An attacker with delegated administrator permissions on the identity provider can submit the masked sentinel value while simultaneously changing the OIDC token endpoint URL. Keycloak accepts the change and continues to use the original client secret against the new, attacker-controlled endpoint.

When Keycloak performs its next token exchange with the modified OIDC provider, it transmits the real client secret to the attacker's URL. The attacker captures the credential and can impersonate the Keycloak instance against the legitimate OIDC provider.

Root Cause

The root cause is improper validation of consistency within input [CWE-1288]. The update handler evaluates the client secret field in isolation. It does not enforce that a masked secret submission requires unchanged token URLs, authorization URLs, or other credential-bearing endpoints.

Attack Vector

Exploitation requires an authenticated delegated administrator account with permission to modify an OIDC identity provider. The attacker edits the identity provider, replaces the token URL with a server they control, and submits the masked sentinel string as the client secret. Keycloak persists the change and later leaks the real secret to the attacker endpoint during token requests.

No verified public exploit code is available. Refer to the Red Hat CVE Advisory and Red Hat Bug Report for authoritative technical details.

Detection Methods for CVE-2026-15943

Indicators of Compromise

Identity provider configuration changes where the OIDC token URL or authorization URL was modified without a corresponding client secret rotation.
Outbound HTTPS requests from Keycloak to unfamiliar or newly registered domains carrying client_secret parameters.
Admin event log entries of type UPDATE_IDENTITY_PROVIDER originating from delegated administrator accounts.

Detection Strategies

Enable Keycloak admin events and review all UPDATE_IDENTITY_PROVIDER entries. Correlate changes to tokenUrl, authorizationUrl, and userInfoUrl fields against approved change tickets.
Alert when a delegated administrator modifies identity provider endpoint URLs but not the client secret field within the same event.
Baseline expected OIDC provider hostnames and flag deviations in outbound Keycloak traffic.

Monitoring Recommendations

Forward Keycloak admin and system event logs to a centralized SIEM for correlation with network egress data.
Monitor outbound TLS connections from Keycloak hosts to non-approved OIDC endpoints.
Review delegated administrator role assignments and audit which principals hold manage-identity-providers permissions.

How to Mitigate CVE-2026-15943

Immediate Actions Required

Restrict the manage-identity-providers role to a minimal set of trusted administrators until patches are applied.
Audit all OIDC identity providers for unexpected changes to tokenUrl, authorizationUrl, or userInfoUrl fields.
Rotate client secrets for any OIDC identity providers whose endpoint URLs were modified by delegated administrators.

Patch Information

Consult the Red Hat CVE Advisory for the fixed Keycloak versions and Red Hat Single Sign-On errata. Apply vendor-supplied updates once available and redeploy affected Keycloak instances.

Workarounds

Require administrators to re-enter the client secret whenever any OIDC endpoint URL is modified, enforced through operational policy and change control.
Remove delegated administrator permissions on identity providers from accounts that do not require them.
Place Keycloak egress traffic behind an allow-list proxy that restricts outbound connections to approved OIDC provider hostnames.

bash

# Configuration example: restrict identity provider management via kcadm.sh
# Remove manage-identity-providers from a delegated admin role
kcadm.sh remove-roles \
  --realm master \
  --rname delegated-admin \
  --cclientid realm-management \
  --rolename manage-identity-providers