Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.9
CVE-2026-89298: Keycloak client registration leaks secret to read‑only admins
CVE-2026-89298 · published 1 month ago
Summary
In Keycloak (Red Hat build of Keycloak and Red Hat Single Sign‑On 7), a user who can only view client settings can request client details and receive the client’s secret in plain text. This lets a read‑only administrator see the password that gives full control over that client, potentially allowing them to act as the client. Apply the latest security update from Red Hat or disable the dynamic client registration endpoint until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat build of keycloak | All versions |
| red hat | red hat single sign-on 7 | All versions |
Original advisory text
A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the...
A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive information, the service returns the client's confidential secret in cleartext. This could allow a read-only administrator to obtain full access to the affected client's account and potentially escalate their privileges within the realm.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-200Information Exposure
Timeline
Published11 Sep 2026
Updated4 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta