A certificate validation flaw was found in the Keycloak Admin CLI kcadm within the org.keycloak.client.cli.util package. When an administrator uses the truststore option to specify a custom CA, the underlying HTTP client incorrectly enables TrustSelfSignedStrategy. This configuration causes the client to trust any self-signed certificate presented by the server, provided the hostname matches, effectively bypassing the intended trust material.
An attacker who can perform a Man-in-the-Middle MitM attack or redirect DNS can present a self-signed certificate for the Keycloak hostname. Successful exploitation allows the attacker to intercept administrative traffic, capture sensitive bearer tokens or credentials, and inject forged responses to execute privileged administrative commands on the Keycloak server.