A vulnerability in the Keycloak keycloak-services component allows a delegated administrator to update an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real client secret even when security-sensitive fields such as the token URL are changed. This flaw enables an attacker with delegated admin privileges to redirect and capture the secret. The issue has a CVSS score of 5.5 (medium severity).