A vulnerability in the Kerberos federation provider of Keycloak allows an attacker on the same network to spoof the Key Distribution Center (KDC) when Kerberos password authentication is used without SPNEGO. This flaw enables bypassing the authentication process and potentially gaining unauthorized access to user accounts.