The kcadm tool in the Keycloak Admin CLI incorrectly accepts any self‑signed certificate when a custom truststore is used and the hostname matches. This flaw allows an attacker to present a forged TLS connection that the tool will trust, enabling the attacker to intercept or craft administrative interactions with a Keycloak server. The result is that the attacker can obtain administrative credentials or otherwise manipulate the server with elevated privileges. This vulnerability represents a misuse of certificate trust and falls under the 295 OWASP weakness of using a self‑signed certificate without proper validation.

Red Hat AMQ Broker 7, Red Hat Build of Keycloak, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8, Red Hat Satellite 6, and Red Hat Single Sign-On 7 are all impacted. No specific affected product versions are listed in the data available, so any installation that includes the kcadm command and uses a custom truststore may be vulnerable.

The CVSS score is 8, indicating high severity. EPSS information is not available, but the flaw is active and can be leveraged over the network by an adversary who can mount a man‑in‑the‑middle against the Keycloak Admin CLI. The vulnerability is not yet listed in the CISA KEV catalog, but it exposes critical administrative capabilities and thus poses a significant risk to organization infrastructure.