A vulnerability in Keycloak's Dynamic Client Registration service allows users with the view-clients role to retrieve client secrets in cleartext. This exposure could enable a read-only administrator to gain full access to the affected client's account and potentially escalate privileges within the realm. The flaw is identified as CVE-2026-89298 and has a medium severity rating with a CVSS score of 4.9. A security update is available in Red Hat build of Keycloak 26.6.8 that addresses this and other issues.