8.0 High

CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates

Description

A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: High
Privileges required: None
Interaction: Required
Scope: Changed
Confidentiality: High
Integrity: High
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Red Hat AMQ Broker 7	Versions not published
Red Hat Build of Keycloak	Versions not published
Red Hat Fuse 7	Versions not published
Red Hat JBoss Enterprise Application Platform 7	Versions not published
Red Hat JBoss Enterprise Application Platform 8	Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack	Versions not published
Red Hat Satellite 6	Versions not published
Red Hat Single Sign-On 7	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2539294 bugzilla.redhat.com

Timeline

Published November 5, 2026
Last modified November 5, 2026

The 88 CVEs of Red Hat AMQ Broker 7 →

CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 High CVE-2026-101292 Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in… 8.2 High CVE-2026-93562 A flaw was found in Netty's HTTP/1 decoder 6.5 Medium CVE-2026-93574 A flaw was found in Netty's `netty-codec-http` component 6.5 Medium

Track this CVE