CVE-2026-95503 PUBLISHED

Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled

Assigner: redhat
Reserved: 22.09.2026 Published: 22.09.2026 Updated: 22.09.2026

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 6.8

Product Status

Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected
Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected
Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected
Vendor Red Hat
Product Red Hat Single Sign-On 7
Versions Default: affected

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Credits

  • Red Hat would like to thank Leo Jianze (lijianze98@gmail.com) for reporting this issue.

References

Problem Types

  • Improper Verification of Cryptographic Signature CWE