CyberRota Analysis
AI-GeneratedA vulnerability in the Keycloak Admin REST API allows delegated administrators with view-only permissions to access actual client secrets stored in a secure vault due to improper boundary enforcement. This exposure of sensitive credentials poses a risk to the integrity of security realms and client management. Organizations using Keycloak should prioritize addressing this issue to safeguard their sensitive information and maintain secure access controls.
Original NVD Description
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.
Related CVEs
Other vulnerabilities affecting the same vendor(s)