CVE-2026-95503 is a vulnerability in the Kerberos federation provider of Red Hat Build of Keycloak. When Kerberos password authentication is used without SPNEGO, the system does not verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This improper verification allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts. The root cause is the lack of server ticket verification during Kerberos password authentication. The vulnerability has been assessed by Red Hat as Important with a CVSS v3.1 score of 6.8 (medium severity).

Successful exploitation allows an attacker on the same network to impersonate the KDC, bypass authentication, and gain unauthorized access to user accounts. This results in a complete authentication bypass, compromising confidentiality and integrity of the system. There is no impact on availability reported.

Currently, no mitigation or patch meeting Red Hat's criteria for ease of use, deployment, applicability, or stability is available. Users should monitor Red Hat advisories for updates. Since no official fix or workaround is provided, cautious use of Kerberos password authentication without SPNEGO is advised. Red Hat Product Security recommends upgrading to a fixed version once available or consulting with a Technical Account Manager for tailored guidance.