Keycloak’s client registration component allows an authenticated client owner to expose vault‑backed secrets. By updating a client secret to reference a vault entry and then retrieving the client configuration, the owner can see the secret in plain text. The flaw, classified as CWE‑200, results in the unintentional disclosure of sensitive credentials that should remain confidential to the client owner.

Red Hat Build of Keycloak and Red Hat Single Sign‑On 7 are affected. No specific product version information is included in the vulnerability report, so all releases of these products that include the unpatched client registration implementation are potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity. There is no EPSS data available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. Based on the description, the attack would require an authenticated client owner who can modify client secrets and craft a reference to a vault entry. This condition is inferred from the provided details and is not directly confirmed. The likelihood of exploitation is therefore considered low, but the potential impact of credential exposure remains significant. The vulnerability does not provide a vector for arbitrary code execution or privilege escalation beyond the client owner’s permissions.