A vulnerability in Keycloak Quarkus Server allows sensitive HTTP headers such as Authorization and Cookie to be logged in cleartext when verbose user-supplied logging patterns are used. An attacker with access to these logs could extract credentials like bearer tokens and session cookies, potentially leading to user impersonation and account compromise. Patches addressing this issue are available in Keycloak version 26.5.6 and later.