Keycloak Logging Vulnerability Reveals Sensitive Headers in Cleartext

A vulnerability in Keycloak allows sensitive headers, including Authorization and Cookie, to be logged in cleartext when the logging format is set to a verbose, user-defined pattern, such as the 'long' pattern. This flaw enables an attacker with access to the log files to extract credentials like bearer tokens and session cookies, which can be used to impersonate users and fully compromise their accounts.

Impact

Exploitation of this vulnerability could lead to unauthorized access and full account compromise for users whose credentials are logged in cleartext.