The vulnerability arises because the environment option KC_CACHE_EMBEDDED_MTLS_ENABLED intended to enable encrypted communication for JGroups replication in Keycloak is ineffective. Consequently, JGroups replication traffic is transmitted in plain text, exposing sensitive information to attackers who have access to adjacent networks. Red Hat's advisory confirms that Keycloak versions 22 and 24 are not affected and that their shipped builds correspond to these versions. The CVSS 3.1 base score is 5.7 (medium severity) with an attack vector of adjacent network, low attack complexity, and low privileges required. The impact is high confidentiality loss but no integrity or availability impact.

An attacker with access to adjacent networks related to JGroups can intercept and read sensitive information transmitted in clear text due to the ineffective encryption option. This compromises confidentiality but does not affect integrity or availability. The vulnerability does not affect Red Hat's shipped Keycloak versions 22 and 24, reducing the impact for those users. There are no known exploits in the wild at this time.

Red Hat's advisory states that Keycloak versions 22 and 24 are not affected, and these are the versions they ship. No explicit patch or fix is currently available or mentioned. Users should verify their Keycloak version and upgrade to 22 or 24 if using an affected version. Since no official fix is stated, monitoring the vendor advisory for updates is recommended. No additional mitigations are specified by the vendor.