CVE-2026-15943

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the keycloak-services component responsible for identity provider management. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, the system reuses the existing real secret even if security-sensitive fields, such as the token URL, have been modified. This behavior allows an attacker to redirect and capture the secret.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.