A sensitive information disclosure flaw was found in the Keycloak Admin REST API. The vulnerability exists in the GET /admin/realms/{realm}/clients/{clientUuid}/client-secret/rotated endpoint. When a confidential client is configured to use a vault-backed rotated secret (e.g., using a placeholder like ${vault.rotated-secret}), the endpoint returns the resolved plaintext value from the vault instead of the placeholder string.
This issue specifically affects the rotated secret and not the primary client secret. Exploitation requires the attacker to have high privileges, specifically the realm-management:view-clients role. A successful attack allows a delegated administrator to bypass vault security boundaries and obtain usable client credentials, which could be used to impersonate the affected client.