A vulnerability in Keycloak's client registration component allows an authenticated client owner to trick the system into revealing sensitive secrets stored in a vault. By updating a client secret to reference a vault entry and then requesting the client configuration, the secret value can be exposed in plaintext. Exploitation requires possession of a valid Registration Access Token and knowledge of Vault aliases. No official fix or mitigation currently meets Red Hat's criteria for deployment and stability.