CVE-2026-95503: Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.
Other sources
A flaw was found in the keycloak-services component where it fails to properly validate the KDC identity during Kerberos password authentication. When Kerberos password mode is enabled without SPNEGO/negotiate authentication, Keycloak does not request a server ticket in the name of the authenticating user to verify the KDC response. An attacker capable of performing DNS, ARP, or DHCP spoofing on the local network can provide a fraudulent KDC response. Successful exploitation allows an attacker to bypass authentication entirely and impersonate any user, leading to unauthorized access to sensitive data and administrative functions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Keycloak's Kerberos federation provider with Kerberos password authentication enabled and without SPNEGO/negotiate authentication are exposed. The issue is specifically tied to this authentication mode.
What does an attacker need to exploit the flaw?
An attacker must be able to spoof the KDC on the same network, such as through DNS, ARP, or DHCP spoofing. No prior privileges or user interaction are required, but the described attack has high complexity.
What is the likely impact of a successful attack?
A successful attacker can bypass authentication and impersonate any user. This can provide unauthorized access to sensitive data and administrative functions.
What configuration change can reduce exposure if patching is not immediately possible?
Avoid using Kerberos password authentication without SPNEGO/negotiate authentication. The described flaw applies when password mode is enabled without SPNEGO.