Keycloak Lets a Delegated Admin Move the Token URL Without Re-Entering the Secret. The Stored Secret Follows.

A flaw in Keycloak’s IdentityProviderResource component allows for the inadvertent reuse of masked client secrets during OIDC configuration updates, creating a path for credential interception. Disclosed on October 13, 2026, CVE-2026-15943…