Description

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive information, the service returns the client's confidential secret in cleartext. This could allow a read-only administrator to obtain full access to the affected client's account and potentially escalate their privileges within the realm.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-11T14:17:37.173Z",
  "pubdate": "2026-09-11T14:17:37.173Z",
  "executiveSummary": "A sensitive information disclosure vulnerability exists in the Dynamic Client Registration service within Keycloak. The flaw arises from inadequate masking of client metadata when processed by the registration endpoint. Specifically, the system fails to redact the client's confidential secret when accessed by authenticated users holding the 'view-clients' role. This vulnerability presents a critical security risk as it allows unauthorized retrieval of credentials used for client-side authentication. An attacker possessing read-only administrative privileges can exploit this to obtain cleartext secrets, enabling impersonation of the target client. This exposure facilitates unauthorized access to secured resources, potential lateral movement, and privilege escalation within the identity realm. The vulnerability compromises the confidentiality of client credentials, thereby undermining the security posture of the authentication architecture. Exploitation is limited to authenticated users with specific administrative roles, but the impact is severe, effectively bypassing the security controls intended to protect confidential client secrets from non-privileged viewing.",
  "technicalDetails": "The vulnerability resides within the Dynamic Client Registration service logic of Keycloak, specifically during the handling of retrieval requests for existing client configurations. When an authenticated user—authorized with the 'view-clients' role—submits a request to the client registration endpoint to inspect a specific client, the application layer fails to implement necessary filtering or masking mechanisms on the returned object model.\nRoot Cause Analysis: The underlying defect is an improper access control implementation within the data serialization process. While the 'view-clients' role is intended to provide read-only access to client metadata, the application does not differentiate between non-sensitive configuration parameters (such as redirect URIs or client display names) and highly sensitive security material, specifically the 'client secret'. Consequently, the server-side response body includes the cleartext 'client secret' field in the JSON payload returned to the client.\nExploitation Flow: An attacker must first possess valid credentials for an account assigned the 'view-clients' role within the Keycloak realm. 1. The attacker authenticates to the Keycloak instance and obtains a valid access token. 2. The attacker crafts a GET request targeting the Dynamic Client Registration endpoint, specifying the resource identifier (client ID) of the target client. 3. The service processes the request, retrieves the client's full entity representation from the database, and serializes the object into a JSON response without redacting the sensitive secret fields. 4. The attacker receives the response containing the cleartext secret, which is then used to perform unauthorized operations or authenticate as the target client in subsequent requests.\nImpact Analysis: The successful extraction of the client secret grants the attacker the ability to perform client-level authentication. In scenarios where the client is configured with high-privilege scopes or access to sensitive APIs, this effectively constitutes an escalation of privilege. The attacker can perform any action permitted by the client's permissions, leading to potential data breaches, unauthorized modifications, or complete account takeover of the client identity within the IAM ecosystem. The exposure is persistent and remains valid until the secret is manually rotated by an administrator, provided the vulnerability remains unpatched."
}