Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.

Etkilenen sürümler8 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-96453 Diğer

Kayıt geçmişi

1. 5 Kas 2026 20:15Yayımlandı

İlgili açıklar

• 7,1 CVE-2026-97847Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim m…
• 8,8 CVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
• 6,8 CVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
• 7,4 CVE-2026-93998Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
• 8,1 CVE-2026-92857Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
• 7,4 CVE-2026-92855Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession