CVE-2026-95503 | BDVDB-2026-377965 Detail

Description#

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-22Record published in the CVE List.
2. Version 22026-11-06Most recent update recorded in the CVE List.