{"id":"CVE-2026-96453","published":"2026-11-05T18:17:11.270","lastModified":"2026-11-05T18:17:11.417","description":"A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-295"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96453","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539294","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}