The Keycloak Admin REST API does not verify the intended audience of bearer tokens during authentication, which means an attacker who runs a client inside a realm can capture an administrator's token and reuse it to perform unauthorized administrative actions. This flaw allows escalation of privileges and can lead to a full compromise of the realm. The weakness is categorized as Improper Authentication (CWE‑287).

This vulnerability affects the Keycloak identity and access management platform. No specific version range is supplied in the CVE data, so all installations should verify whether the current version implements proper audience checks for admin tokens.

With a CVSS score of 6.8, the vulnerability presents a moderate risk. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The likely attack vector is remote and network‑based; an adversary who can control a client application within the targeted realm can intercept bearer tokens and reuse them without needing additional credentials. Because the flaw allows reuse of an administrator’s token, the impact is significant if the attacker succeeds.