The LDAP testing endpoint allows to change the Connection URL  independently of and without having to re-enter the currently configured LDAP bind credentials. An attacker with admin access (permission manage-realm) can change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker.
As a consequence, an attacker who has compromised the admin console/compromised a user with sufficient privileges can leak domain credentials and can now attack the domain.

This requires: Access to the REST endpoint and the admin user needed with manage-realm permission (full access to LDAP configuration and all identity providers).

Version affected: <= 24.0.5