Bug 2537744 (CVE-2026-95503)

Summary: CVE-2026-95503 keycloak-services: keycloak-services: Potential KDC spoofing bypass when Kerberos password authentication is enabled
Product: [Other] Security Response Reporter: Abhishek Raj <abhraj>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Abhishek Raj 2026-09-22 06:49:17 UTC 
A flaw was found in the keycloak-services component where it fails to properly validate the KDC identity during Kerberos password authentication. When Kerberos password mode is enabled without SPNEGO/negotiate authentication, Keycloak does not request a server ticket in the name of the authenticating user to verify the KDC response. An attacker capable of performing DNS, ARP, or DHCP spoofing on the local network can provide a fraudulent KDC response. Successful exploitation allows an attacker to bypass authentication entirely and impersonate any user, leading to unauthorized access to sensitive data and administrative functions.