CVE-2026-95503 in Keycloak
Summary
by MITRE • 09/22/2026
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in the Kerberos federation provider within Keycloak represents a critical failure in cryptographic identity verification during specific authentication flows. Specifically, when administrators configure Kerberos password-based authentication without employing SPNEGO for negotiation, the system exhibits a significant deviation from standard security protocols defined by RFC 4120 and related IETF standards. In a properly secured Kerberos environment, the client must validate that the ticket-granting service or key distribution center responding to its request is legitimate. This validation typically involves verifying cryptographic signatures and ensuring that the server identity matches expected principals. However, in this flawed implementation, Keycloak fails to perform adequate verification of the KDC's identity when requesting a server ticket under these specific conditions. The absence of SPNEGO removes an additional layer of protocol negotiation that might otherwise enforce stricter mutual authentication requirements, leaving the handshake process vulnerable to interception and manipulation by malicious actors operating on the same network segment.
From a technical perspective, this flaw constitutes a classic man-in-the-middle attack vector where the integrity of the initial authentication exchange is compromised. An attacker positioned between the client and the Keycloak server can intercept the Kerberos requests and respond with forged tickets generated from a spoofed KDC. Because the system does not rigorously verify that the responding entity holds the legitimate private keys associated with the trusted domain controller, it accepts the fraudulent credentials as valid. This allows the adversary to impersonate any user whose authentication is being processed through this specific pathway. The core issue lies in the lack of mutual authentication mechanisms during the ticket exchange phase, which violates fundamental principles of secure distributed computing where trust must be established bidirectionally between client and server services before sensitive session data or access tokens are issued.
The operational impact of this vulnerability is severe, as it directly undermines the confidentiality and integrity of user identities managed by Keycloak. Successful exploitation enables an attacker to bypass authentication controls entirely, granting them unauthorized access to protected resources associated with compromised accounts. This could lead to privilege escalation if the targeted account possesses administrative rights or elevated permissions within downstream applications integrated with Keycloak. Furthermore, because Kerberos is often used in enterprise environments for single sign-on capabilities across multiple services, a breach at this level can serve as an entry point for lateral movement throughout the network infrastructure. Attackers may leverage these stolen credentials to access sensitive data, modify configurations, or establish persistent backdoors within the identity management ecosystem, thereby compromising the entire trust chain that relies on Keycloak for authentication decisions.
Mitigation strategies must address both immediate configuration adjustments and long-term architectural improvements. The most effective short-term remedy is to disable Kerberos password-based authentication without SPNEGO in all production environments where this vulnerability applies. Administrators should ensure that only authenticated service principals using robust negotiation mechanisms are permitted, thereby enforcing mutual authentication requirements inherent in modern Kerberos implementations. Additionally, organizations should implement network segmentation and monitor for anomalous Kerberos traffic patterns indicative of ticket forgery or KDC spoofing attempts. Deploying intrusion detection systems capable of analyzing Kerberos protocol anomalies can provide early warning signs of exploitation activity. Long-term solutions involve updating Keycloak to versions where this logic flaw has been corrected by the vendor, ensuring that all future authentication flows strictly adhere to RFC standards for identity verification and ticket validation processes.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding the failure to verify server identity during protocol exchanges. It also maps closely to MITRE ATT&CK technique T1550, particularly sub-technique T1550.003 known as Pass-the-Ticket, although in this case, the attacker generates their own tickets rather than stealing existing ones due to the lack of verification. Understanding these mappings helps security teams contextualize the risk within broader threat landscapes and prioritize remediation efforts accordingly. By addressing this flaw, organizations can restore confidence in the integrity of their identity federation services and prevent unauthorized access stemming from weakened cryptographic assumptions during Kerberos authentication sequences.