CVE-2026-16104: Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.
Other sources
An Information Exposure vulnerability was found in the GET /admin/realms/{realm}/authentication/config/{id} endpoint of Keycloak. The root cause is located in the ModelToRepresentation.toRepresentation method, which copies the configuration map without filtering or masking entries marked as secret in the provider metadata. Consequently, an authenticated user with the view-realm role can retrieve raw secret values, such as secret.key for reCAPTCHA and api.key for reCAPTCHA Enterprise. Additionally, these unmasked secrets are serialized into admin events, making them visible to any user with permission to read administrative logs. An attacker can use these secrets to undermine the integrity of bot-detection mechanisms in the affected realm.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16104?
The severity of CVE-2026-16104 is medium with a score of 4.3.
What does CVE-2026-16104 affect?
CVE-2026-16104 affects the keycloak-services component of Keycloak, specifically the authentication configuration endpoint.
How do I fix CVE-2026-16104?
To mitigate CVE-2026-16104, ensure that only trusted administrators have access to configuration values and consider applying any available updates or patches from Keycloak.
What is exposed in CVE-2026-16104?
CVE-2026-16104 exposes raw reCAPTCHA secret keys to view-only administrators on the authentication configuration endpoint.
What is the impact of CVE-2026-16104 on security?
The impact of CVE-2026-16104 can lead to unauthorized access to sensitive reCAPTCHA secrets, potentially compromising the security of web applications relying on them.