CVE-2026-95503 - Red Hat Build of Keycloak Kerberos federation provider fails to request a server ticket when password authentication is used without SPNEGO. An attacker on the adjacent network can spoof the KDC and bypass authentication. Red Hat severity: Important · CVSS 3.1: 6.8 The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for a complete authentication bypass. Successful exploitation allows an attacker to impersonate users and gain unauthorized access to the system. The vulnerability's root cause is the lack of server ticket verification when Kerberos password authentication is used, failing to ensure the authenticity of the KDC. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Post summary
The advisory discloses CVE-2026-95503 in Red Hat Build of Keycloak, describing an authentication bypass due to missing Kerberos server ticket verification (CVSS 6.8, Important), with no PoC, exploit, or patch provided.
