A logic error in the client-kubernetes-secret authenticator shipped with UDS Identity Config causes the supplied client_secret to be overwritten by the mounted Kubernetes secret before comparison, allowing anyone who knows a client_id to authenticate with any client_secret value. This results in the issuance of OAuth2 tokens scoped to the targeted client’s service account. If the client is the uds-operator, the attacker can then use the token to register or modify other clients, potentially giving broad control over the system.

The vulnerability affects defenseunicorns UDS Identity Config versions 0.11.0 through 0.26.0, which provide the Keycloak client authenticator used by UDS Core’s Identity deployment. The flaw is resolved in version 0.26.1. Systems running any of the affected releases and exposing the Keycloak token endpoint are at risk.

With a CVSS score of 10, this flaw represents a critical high‐impact vulnerability. Although EPSS data is unavailable, the lack of a known exploitation pattern and absence from the CISA KEV catalog suggest it is not yet widely exploited, yet the straightforward attack path—access to the token endpoint combined with knowledge of a client_id—makes exploitation highly feasible for an attacker with network reach to Keycloak. The potential for escalation is significant, particularly for privileged client accounts.