Vulnerability in Keycloak's Dynamic Client Registration Service Exposes Sensitive Information

CVE-2026-89298

What is CVE-2026-89298?

A security flaw has been identified in Keycloak's Dynamic Client Registration service, which is responsible for managing client credentials in an open-source identity and access management system. This vulnerability arises when users assigned the view-clients role access the client registration endpoint. The service fails to adequately mask sensitive information, resulting in the disclosure of confidential client secrets in cleartext. Consequently, an unauthorized read-only administrator may exploit this oversight to gain full access to the affected client's account, significantly heightening the risk of privilege escalation within the system.

References