The flaw lies in the Dynamic Client Registration service of Keycloak. When a user possessing the view‑clients role accesses the client registration endpoint, the service fails to hide sensitive details and returns a client’s confidential secret in cleartext. This exposes the secret to anyone who can assume the view‑clients role, effectively allowing a read‑only administrator to obtain full access to the affected client’s configuration and potentially elevate their privileges within the realm.

The vulnerability affects Red Hat’s Build of Keycloak and Red Hat Single Sign‑On 7. No explicit version numbers are listed, so any installations of those products using the default client registration service are potentially exposed.

The CVSS score of 4.9 indicates moderate severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a legitimate user with the view‑clients role hitting the client registration endpoint; the exploitation conditions are minimal—no additional privileges or code execution are required. An attacker can read the client secret and, if that client is used for authentication flows, could impersonate the client to obtain broader access.