CVE-2026-95503: Keycloak Kerberos Auth Bypass Vulnerability

CVE-2026-95503 Overview

A vulnerability exists in the Kerberos federation provider of Keycloak, the open-source identity and access management (IAM) platform maintained by Red Hat. When Kerberos password authentication runs without Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO), Keycloak does not verify the Key Distribution Center (KDC) by requesting a server ticket. An attacker positioned on the same network can spoof the KDC and bypass authentication. Successful exploitation grants unauthorized access to user accounts brokered through the affected federation provider. The flaw is tracked as [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
Adjacent-network attackers can impersonate the KDC, bypass Kerberos authentication in Keycloak, and gain unauthorized access to federated user accounts.

Affected Products

Red Hat Keycloak (Kerberos federation provider)
Red Hat build of Keycloak
Deployments using Kerberos password authentication without SPNEGO

Discovery Timeline

2026-09-22 - CVE-2026-95503 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95503

Vulnerability Analysis

Keycloak supports Kerberos as an external user federation source. Administrators can enable password-based Kerberos authentication as an alternative to SPNEGO ticket negotiation. In the vulnerable code path, Keycloak accepts the username and password, obtains a Ticket Granting Ticket (TGT) from a KDC on the network, and treats a successful TGT response as proof of user identity.

The flaw is that Keycloak does not perform the follow-up step of requesting a service ticket for a known keytab-backed principal. Without this step, there is no cryptographic proof that the responding KDC controls the expected long-term key. An attacker who can answer Kerberos traffic on the adjacent network can present a rogue KDC that accepts arbitrary credentials.

The result is an authentication bypass mapped to [CWE-347]. Confidentiality and integrity impact are rated high, while availability is not affected.

Root Cause

The root cause is missing mutual authentication between Keycloak and the KDC. Standard Kerberos guidance requires the client to validate the KDC by obtaining and verifying a service ticket using a locally stored keytab. The Keycloak Kerberos federation provider skips this validation step in the non-SPNEGO password flow.

Attack Vector

Exploitation requires network adjacency to the Keycloak server and the ability to intercept or respond to Kerberos protocol traffic destined for the legitimate KDC. Techniques include ARP spoofing, DHCP option manipulation, DNS poisoning of the _kerberos._udp SRV record, or operating a rogue KDC on a segment reachable by Keycloak. Once traffic is redirected, the attacker returns a forged AS-REP for any username and password the attacker chooses, and Keycloak authenticates the account.

No public proof-of-concept exploit is listed for this CVE. Technical details are described in prose only. See the Red Hat CVE-2026-95503 Advisory and Red Hat Bug #2537744 Report for vendor context.

Detection Methods for CVE-2026-95503

Indicators of Compromise

Kerberos AS-REP traffic to or from IP addresses that are not the sanctioned KDCs for the realm.
Unexpected ARP, DHCP, or DNS changes on the segment hosting Keycloak, especially affecting _kerberos._udp or _kerberos._tcp SRV records.
Successful Keycloak logins for Kerberos-federated users without a corresponding authentication event in the legitimate Active Directory or MIT Kerberos KDC logs.

Detection Strategies

Correlate Keycloak LOGIN events for Kerberos-federated users against KDC authentication logs and alert on Keycloak successes that lack a matching KDC record.
Monitor network flows from the Keycloak host on UDP/TCP 88 and alert on destinations outside the approved KDC allowlist.
Baseline the SRV records that Keycloak resolves for the Kerberos realm and alert on deviations.

Monitoring Recommendations

Forward Keycloak server, audit, and event logs to a centralized analytics platform for correlation with directory and network telemetry.
Enable Kerberos event auditing on domain controllers and ingest events to spot missing KDC authentications for accounts that logged into Keycloak.
Track configuration changes to Keycloak user federation providers, especially toggles that disable SPNEGO or enable password-based Kerberos flows.

How to Mitigate CVE-2026-95503

Immediate Actions Required

Apply the Keycloak security update referenced in the Red Hat CVE-2026-95503 Advisory as soon as it is available for your distribution.
Inventory all Keycloak realms and user federation providers to identify those configured for Kerberos password authentication without SPNEGO.
Restrict network paths between Keycloak servers and KDCs to trusted VLANs and enforce Layer 2 controls that block ARP and DHCP spoofing.

Patch Information

Refer to the Red Hat CVE-2026-95503 Advisory and Red Hat Bug #2537744 Report for the list of fixed Keycloak and Red Hat build of Keycloak versions. Deploy the fixed release to all Keycloak nodes and restart the service so the corrected Kerberos federation provider is loaded.

Workarounds

Require SPNEGO-based Kerberos authentication and disable the password-only Kerberos flow in affected realms until the patch is applied.
Provide Keycloak with a valid service keytab and configure the Kerberos federation provider to use it, so KDC responses can be validated cryptographically.
Segment Keycloak into a management network that only permits Kerberos traffic to the sanctioned KDC IP addresses.

bash

# Example: disable Kerberos password authentication on a Keycloak user federation provider
# Review and adapt for your Keycloak version before applying in production
kcadm.sh update components/<component-id> -r <realm> \
  -s 'config.allowKerberosAuthentication=["true"]' \
  -s 'config.allowPasswordAuthentication=["false"]' \
  -s 'config.keyTab=["/etc/krb5.keytab"]' \
  -s 'config.serverPrincipal=["HTTP/sso.example.com@EXAMPLE.COM"]'