VULNERABILITY INTELLIGENCE
CVE-2026-95503
CVSS score6.8 MEDIUM
EPSS probability0.19%
CISA KEVNot currently listed
Published2026-09-22
Last modified2026-09-22
CVSS vectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.
Weakness classification
- secalert@redhat.com: CWE-347