CVE-2026-16104
Medium
Description
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Redhat Build Of Keycloak
PublishedJul 17, 2026
First seenJul 17, 2026
Weakness typeCWE-212CWE-212
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat build_of_keycloak | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.