CVE-2026-95503 — Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without S…
Published: 2026-09-22 · CVSS: 6.8 · CVSS 3.1
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7