CVE-2026-16104 | A flaw was found in the authentication configuration endpoin… | CVSS 4.3 MEDIUM

Description

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.

Metadata

CVE ID: CVE-2026-16104
State: PUBLISHED
Assigner: redhat
Reserved: 2026-07-17 14:48 UTC
Published: 2026-07-17 16:43 UTC
Last updated: 2026-07-17 17:24 UTC
Primary CWE: CWE-522
CWE-522 Insufficiently Protected Credentials
Vendor / Product: Red Hat / Red Hat Build of Keycloak
Sources: cve.org · NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (6)

Vendor	Product	Platform	Versions
Red Hat	Red Hat Build of Keycloak	—	—
Red Hat	Red Hat Build of Keycloak	—	—
Red Hat	Red Hat Build of Keycloak	—	—
Red Hat	Red Hat Data Grid 8	—	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—	—
Red Hat	Red Hat Single Sign-On 7	—	—

Weakness (CWE)

CWE	Source	Description
CWE-522	adp	CWE-522 Insufficiently Protected Credentials

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References (2)