A vulnerability in the Admin REST API of Keycloak allows an attacker operating a client within a realm to capture and reuse an administrator's access token. This is due to the Admin API failing to verify the intended audience of bearer tokens during authentication. Exploitation can lead to unauthorized administrative actions and potentially full realm compromise.