A flaw in the Dynamic Client Registration GET endpoint of Red Hat Build of Keycloak causes failure to mask sensitive client secrets when accessed by users with the view-clients role. This results in exposure of confidential client secrets in cleartext, allowing those users to impersonate clients and potentially escalate privileges. The vulnerability is due to missing secret masking on the client registration endpoint. Red Hat has assessed the severity as moderate and has not yet provided an official fix or mitigation that meets their criteria.

The vulnerability exposes confidential client secrets to users with the view-clients administrative role. This can lead to unauthorized impersonation of clients and potential privilege escalation within the Keycloak realm. However, exploitation requires the attacker to already have high privileges (view-clients role), limiting the scope of impact.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. Since exploitation requires the view-clients role, restricting assignment of this role to trusted administrators is a recommended precaution until a fix is available.