CVE-2026-95503: Red Hat Build Of Keycloak

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.

Affected products

• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Single Sign-On 7

Published 2026-09-22. Last modified 2026-09-22.