CVE-2026-95503

6.8 MEDIUM

Published 2026-09-22 · Updated 2026-09-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-347

All references

https://access.redhat.com/security/cve/CVE-2026-95503
https://bugzilla.redhat.com/show_bug.cgi?id=2537744

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-16443
HIGHCVE-2026-75939
HIGHCVE-2026-94368
MEDIUMCVE-2026-9832

Related by shared AI tags and CWE weakness class. Browse the full archive.