A Missing Audience Check vulnerability was identified in the Keycloak Admin REST API. The flaw exists in the AdminRoot.authenticateRealmAdminRequest function, which constructs a BearerTokenAuthenticator without specifying an expected audience. Consequently, the audience validation step in AuthenticationManager.verifyIdentityToken is bypassed. An attacker who operates or compromises a client in a realm can capture an access token from an authenticating administrator (requiring user interaction). If the token contains administrative roles—which is common when the default full scope allowed setting is enabled—the attacker can replay this token against the Admin API. Successful exploitation allows the attacker to perform any action permitted by the captured roles, such as modifying realm configurations, managing users, or deleting resources.