A sensitive information disclosure flaw was found in the org.keycloak.services.clientregistration component of Keycloak. The issue arises when Keycloak is configured with an active Vault provider and Dynamic Client Registration endpoints are enabled. An authenticated attacker holding a valid Registration Access Token (RAT) for a confidential client can update the client secret to a Vault reference expression, such as vault.alias. When the attacker subsequently requests the client installation configuration through the registration endpoint, Keycloak improperly resolves the Vault expression and returns the managed secret in plaintext. An attacker with knowledge of existing Vault secret aliases in the realm can exploit this to read arbitrary Vault values without possessing administrative privileges.