CVE-2026-95503
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Sep 22, 2026
Vendor
unknown
Description
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.