Improper validation of TLS certificates in Liman Render Engine’s Keycloak connections permits attackers to perform a man‑in‑the‑middle attack, potentially intercepting or altering encrypted traffic. The vulnerability is driven by CWE‑295, a flaw that allows bypassing certificate verification during the TLS handshake. With a CVSS score of 5.9, the issue is considered moderate and could lead to confidentiality or integrity violations if an adversary can insert malicious certificates.

The vulnerability affects HAVELSAN Inc.’s Liman Render Engine for all versions from 1.0 up through 1.2‑74. Versions 1.2‑75 or newer are not affected because certificate verification for Keycloak connections has been restored. Any deployment using version 1.2‑74 or earlier remains vulnerable and should be brought up‑to‑date.

Because the flaw exists in the TLS client side, an attacker on the same network path as the Keycloak connection can intercept traffic, substitute a fraudulent certificate, and gain access to sensitive data. The CVSS rating of 5.9 indicates moderate severity. The EPSS score of < 1 % shows an extremely low probability of exploitation in the general population, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at present. Nonetheless, the attack would require network access to the Keycloak interface and the ability to present a forged certificate during the TLS handshake.