This vulnerability in Red Hat Build of Keycloak arises from improper validation of consistency within input during updates to OIDC identity providers. When a delegated administrator updates an identity provider using a masked client secret sentinel value, Keycloak incorrectly reuses the existing real client secret despite changes to critical fields such as the token URL. This behavior can enable an attacker to redirect requests and capture the secret, compromising confidentiality. The CVSS 3.1 base score is 5.5 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No patch or official remediation level is currently indicated in the vendor advisory. The vendor advisory link is provided but does not explicitly confirm patch availability or mitigation steps.

An attacker with delegated administrator privileges can exploit this flaw to redirect and capture the client secret of an OIDC identity provider by exploiting improper validation when updating identity provider configurations. This compromises the confidentiality of the client secret, potentially allowing unauthorized access or impersonation. Integrity and availability impacts are low or none.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15943 for current remediation guidance. Until an official fix is available, restrict delegated administrator privileges to trusted personnel and carefully monitor changes to identity provider configurations to prevent misuse. No vendor-provided mitigation or workaround is currently documented.