@Override
    public boolean validate(final OAuthRegisteredService registeredService, final String clientSecret) {
        if (isClientSecretUndefined(registeredService)) {
            LOGGER.debug("The client secret is not defined for the registered service [{}]", registeredService.getName());
            return true;
        }
        val clientSecretDecoded = EncodingUtils.urlDecode(clientSecret);
        val clientSecretAssigned = SpringExpressionLanguageValueResolver.getInstance().resolve(registeredService.getClientSecret());
        val definedSecret = cipherExecutor.decode(clientSecretAssigned, new Object[]{registeredService});
        if (!StringUtils.equals(definedSecret, clientSecretDecoded)) {
            LOGGER.error("Wrong client secret for service: [{}]. If you intend to use PKCE, note that it does not require a client secret and "
                       + "requests generally must not specify a client secret to CAS.\nFurthermore, you must make sure "
                       + "no client secret is assigned to this registered service in the CAS service registry.",
                        registeredService.getServiceId());
            return false;
        }
        return true;
    }
This is {@link DefaultOAuth20ClientSecretValidator}.

@author Misagh Moayyed
@since 6.6.0
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/DefaultOAuth20ClientSecretValidator.java