CVE-2026-96453Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.0 | HIGH | 3.1redhat (CNA) | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
Details
- CVE ID
- CVE-2026-96453
- Status
- Awaiting Analysis
- Assigner (CNA)
- redhat
- Published
- Nov 5, 2026
- Last modified
- 2026-11-06 19:44 UTC
- Weaknesses
- CWE-295 · Improper Certificate Validation
Affected Products
As published by the CNA in the CVE record.
Red HatRed Hat build of Keycloak 26.40 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.40 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.40 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.4.170 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.4.170 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.4.170 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.60 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.60 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.60 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.6.80 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.6.80 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.6.80 version ranges
No version detail published.
Red HatRed Hat AMQ Broker 70 version ranges
No version detail published.
Red HatRed Hat Fuse 70 version ranges
No version detail published.
Red HatRed Hat JBoss Enterprise Application Platform 70 version ranges
No version detail published.
Red HatRed Hat JBoss Enterprise Application Platform 70 version ranges
No version detail published.
Red HatRed Hat JBoss Enterprise Application Platform 70 version ranges
No version detail published.
Red HatRed Hat JBoss Enterprise Application Platform 80 version ranges
No version detail published.
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack0 version ranges
No version detail published.
Red HatRed Hat Satellite 60 version ranges
No version detail published.
Red HatRed Hat Single Sign-On 70 version ranges
No version detail published.
Red HatRed Hat Single Sign-On 70 version ranges
No version detail published.
Red HatRed Hat Single Sign-On 70 version ranges
No version detail published.
References
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:95759
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:95760
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:95761
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:95762
- access.redhat.com https://access.redhat.com/security/cve/CVE-2026-96453
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2539294