CVE-2026-95503

Executive Summary

CVE-2026-95503 is an improper verification of cryptographic signature (CWE-347) vulnerability in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the provider fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket, allowing an attacker on the same network segment to spoof the KDC and bypass the authentication process. Successful exploitation can yield unauthorized access to user accounts, resulting in high confidentiality and integrity impact; no patch, workaround, or public proof-of-concept is currently available.

Technical Analysis

Keycloak's Kerberos federation provider is designed to delegate authentication to an external Kerberos infrastructure. In a normal Kerberos authentication exchange, a client first authenticates to the Key Distribution Center (KDC) via an Authentication Service (AS) exchange, then obtains a service ticket for the target service via a Ticket Granting Service (TGS) exchange. The service ticket is encrypted with the target service's long-term key, and possession of a valid service ticket is the mechanism by which a service verifies that the KDC actually issued the credential. Requesting and validating this server ticket is what binds the client's identity assertion to a trusted KDC.

Per the NVD description, Keycloak's Kerberos federation provider, when configured for Kerberos password authentication without SPNEGO, does not request a server ticket from the KDC. This means the identity assertion presented by the client is accepted without cryptographic proof that it originated from the legitimate KDC. The trust anchor that binds the credential to the authoritative KDC is therefore absent from the authentication flow.

The vulnerability class is CWE-347, Improper Verification of Cryptographic Signature. In Kerberos terms, the missing verification is the service-ticket validation step. Because the assertion is not cryptographically tied to the real KDC, a network-adjacent adversary who can intercept or answer the relevant Kerberos exchange can impersonate the KDC and return a forged response that the provider accepts. This is fundamentally an adversary-in-the-middle (AiTM) condition: the attacker must be positioned on the same network path as the authentication traffic, which is consistent with the CVSS vector's AV:A (Adjacent Network) classification.

The CVSS vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates:

• AV:A (Adjacent Network): the attacker requires a position on the same network segment or an adjacent network path to the authentication traffic.
• AC:H (High Attack Complexity): exploitation depends on conditions outside the attacker's direct control, such as network positioning, timing, and the target environment being configured for Kerberos password authentication without SPNEGO.
• PR:N (No Privileges Required): no prior authentication to Keycloak is needed.
• UI:N (No User Interaction): no victim action is required.
• S:U (Unchanged Scope): impact remains within the vulnerable component's security authority.
• C:H / I:H (High Confidentiality and Integrity impact): successful spoofing can grant access to user accounts, exposing data and permitting modification of protected resources.
• A:N (No Availability impact): the flaw does not directly degrade availability.

No code-level identifiers, function names, file paths, or API parameters are available in the provided intelligence. The analysis above is limited to the Kerberos protocol mechanism and the vulnerability class described by the NVD text. Any further implementation-specific detail would be speculative and is therefore not asserted here.

Two configuration conditions are required for exposure, both implied by the description:

1. Kerberos federation is configured as an authentication mechanism.
2. Kerberos password authentication is enabled and used in a mode where SPNEGO is not used.

SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism) is a negotiation wrapper that, in a browser/HTTP context, carries Kerberos tokens and enforces the standard ticket-validation semantics. Environments that pair Keycloak Kerberos federation with a username/password fallback path rather than SPNEGO are therefore the relevant exposure surface.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-95503. The steps below are inferred from the vulnerability class and the protocol behavior described in the NVD text. No specific function names, endpoints, or parameters are invented.

1) Reconnaissance and target identification. The attacker identifies a network hosting a Keycloak deployment that uses Kerberos federation, and determines that Kerberos password authentication is in use without SPNEGO. This can be established through passive observation of Kerberos traffic on the segment, knowledge of the target's directory/identity architecture, or by probing the authentication endpoint. The attacker must obtain a position on the same network segment or an adjacent network path to the authentication traffic, consistent with the AV:A vector.

2) Triggering the flaw class. The attacker allows or induces a victim authentication attempt through the Kerberos password authentication path. Because the provider does not request a server ticket from the KDC, the authentication flow lacks a cryptographic check binding the response to the legitimate KDC. The attacker, positioned on-path, can intercept or answer the relevant Kerberos exchange.

3) Impersonation of the KDC. The attacker spoofs the KDC and returns a forged authentication response that the Kerberos federation provider accepts, since the missing server-ticket verification removes the mechanism that would normally prove the response came from the real KDC. This is the core of the bypass: identity is asserted without proof of KDC origin.

4) Post-exploitation impact. Successful exploitation bypasses the authentication process and can result in unauthorized access to user accounts, with high confidentiality and integrity impact (C:H/I:H). Depending on the privileges and roles held by the impersonated account within Keycloak and connected relying parties, the attacker may read protected data and modify protected resources. Availability is not directly affected (A:N).

Because no exploit artifacts are public, defenders should treat this as an unweaponized but feasible AiTM attack that requires network adjacency and a specific Kerberos configuration. Absence of public exploit code does not eliminate risk in environments matching the exposure profile.

Impact Assessment

The primary impact is authentication bypass via KDC spoofing, which directly undermines the trust model of an identity and access management (IAM) platform. Keycloak is frequently deployed as a central identity provider for SSO across many downstream applications; compromising a user account through the Kerberos federation provider can cascade into every application that federates with that Keycloak instance.

Business impact includes:

• Unauthorized account access: attackers may authenticate as legitimate users and access applications and data governed by those identities.
• Confidentiality loss (C:H): exposure of data accessible to impersonated accounts, which in SSO topologies can be broad.
• Integrity loss (I:H): ability to modify protected resources or perform actions as the impersonated user, including within federated applications.
• Trust erosion: because the KDC trust anchor is bypassed, audit trails, authentication logs, and identity assertions may be unreliable indicators of true identity during compromise.

The blast radius is environment-dependent. It is bounded by network adjacency (AV:A), by the specific Kerberos password-without-SPNEGO configuration, and by the privileges of the accounts available to the attacker. Environments that use SPNEGO, or that do not use Kerberos password authentication, do not match the described exposure. The high attack complexity (AC:H) reflects the dependence on network positioning and configuration preconditions. No availability impact is assigned, so denial-of-service is not an expected outcome.

Detection Guidance

Detection should focus on anomalous Kerberos authentication behavior, KDC-impostor indicators on the network, and unusual account access patterns from the IAM platform. Because the flaw is a missing verification step, the strongest signals are network-level and behavioral rather than signature-based.

Sigma Rule

title: Potential Keycloak Kerberos KDC Spoofing via Password Auth Without SPNEGO
id: 9f3c1b62-4a7d-4e51-b0c2-8d6a1f2e7c95
status: experimental
description: Detects suspicious Kerberos authentication activity consistent with KDC spoofing against Keycloak Kerberos federation provider when password authentication is used without SPNEGO (CVE-2026-95503).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95503
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: keycloak
  service: authentication
detection:
  selection_event:
    event_type:
      - 'LOGIN'
      - 'LOGIN_ERROR'
    auth_method|contains: 'kerberos'
  selection_nospnego:
    spnego|exists: false
  selection_anomaly:
    - error|contains: 'invalid'
    - source_ip|exists: true
  condition: selection_event and selection_nospnego and selection_anomaly
falsepositives:
  - Legitimate Kerberos password authentication from expected networks
  - Misconfigured Kerberos federation settings
level: medium
tags:
  - attack.t1557
  - cve.2026.95503

YARA Rule

rule CVE_2026_95503_Keycloak_Kerberos_KDC_Spoof
{
    meta:
        author = "Threat Intelligence"
        description = "Detects references to Keycloak Kerberos password authentication without SPNEGO server-ticket verification (CVE-2026-95503)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95503"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "kerberos" nocase
        $b = "SPNEGO" nocase
        $c = "federation provider" nocase
        $d = "server ticket" nocase
        $e = "service ticket" nocase
        $f = "KDC" nocase
        $m1 = "CVE-2026-95503" wide ascii

    condition:
        uint16(0) == 0x504B or (
            ($m1) or (
                $a and $f and ($d or $e) and not $b
            )
        )
}

Suricata IDS Rule

alert udp any any -> any 88 (msg:"CVE-2026-95503 Possible Keycloak Kerberos KDC Spoofing - Unverified AS/TGS Response"; flow:stateless; dsize:>0; content:"|6a|"; offset:0; depth:1; threshold: type both, track by_src, count 5, seconds 60; reference:cve,2026-95503; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95503; classtype:attempted-user; sid:202695503; rev:1;)

Note: Kerberos uses TCP/UDP port 88. The |6a| byte is the Kerberos message tag for an AS-REP (0x6B) / TGS-REP (0x6C) family of responses per protocol framing; defenders should tune the rule to their Kerberos reply types and correlate with Keycloak source hosts rather than enabling blindly.

Elastic Detection

sequence by source.ip with maxspan=60s
  [ authentication where event.outcome == "failure" and
      process.name : "java" and
      message : "*kerberos*" and not message : "*spnego*" ]
  [ authentication where event.outcome == "success" and
      process.name : "java" and
      message : "*kerberos*" and not message : "*spnego*" ]

Splunk SPL Query

index=keycloak OR index=idm sourcetype=keycloak* ("kerberos" OR "Kerberos")
| eval spnego=if(match(_raw,"(?i)spnego"),1,0)
| eval kdc_missing=if(spnego=0 AND match(_raw,"(?i)(password|authentication)"),1,0)
| where kdc_missing=1
| stats count values(error) as errors values(src_ip) as source_ips by user, host
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="keycloak,authentication,">
  <rule id="100503" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">LOGIN</field>
    <field name="auth_method" type="pcre2">(?i)kerberos</field>
    <field name="spnego" negate="yes" type="pcre2">(?i)true</field>
    <description>CVE-2026-95503: Keycloak Kerberos authentication without SPNEGO - possible KDC spoofing attempt</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <group>cve_2026_95503,</group>
  </rule>

  <rule id="100504" level="12" frequency="5" timeframe="60">
    <if_matched_sid>100503</if_matched_sid>
    <same_field>srcip</same_field>
    <description>CVE-2026-95503: Repeated Keycloak Kerberos auth without SPNEGO from same source - likely KDC spoofing</description>
    <group>cve_2026_95503,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range has been published in the tracked sources. The following measures are configuration- and architecture-level risk reductions rather than vendor-provided fixes.

1) Immediate mitigations

• Eliminate the vulnerable configuration: do not use Kerberos password authentication without SPNEGO. Prefer SPNEGO-based Kerberos federation, which enforces the standard ticket-validation semantics, or disable the non-SPNEGO Kerberos password authentication path entirely until a fix is available.
• Where Kerberos federation cannot be reconfigured immediately, restrict network reachability to KDC and Keycloak authentication traffic so that untrusted hosts cannot occupy an adjacent or on-path position (e.g., segment identity infrastructure, apply network access controls, and prevent rogue KDC responses).
• Enforce Kerberos hardening at the network level, including protection against KDC impersonation such as restricting which hosts may respond to Kerberos requests on the segment and enabling mutual verification wherever the deployment permits.
• Increase monitoring of the Kerberos federation provider and alert on authentications that are inconsistent with expected source networks or KDC addresses.

2) Patch/upgrade steps

• No patched version is identified by any tracked source. Monitor the Keycloak project's advisories and release notes for a fix referencing this issue, then upgrade to the first version that remediates it.
• Until a fix is published, treat any upgrade as unrelated to this CVE and continue to enforce the configuration mitigations above.
• Maintain an inventory of Keycloak instances using Kerberos federation so that patching can be applied rapidly when a fix becomes available.

3) Long-term hardening

• Reduce reliance on Kerberos password authentication flows in favor of SPNEGO, certificate-based, or other phishing- and spoofing-resistant authentication methods.
• Apply network segmentation and zero-trust controls to identity infrastructure, given that exploitation depends on network adjacency (AV:A).
• Continuously audit identity provider configuration for weakened or bypassed cryptographic verification steps and enforce secure defaults across federation providers.
• Integrate the detection rules above into SOC monitoring and validate them against staging environments to reduce false positives from legitimate Kerberos authentication.

References

• NVD — CVE-2026-95503: https://nvd.nist.gov/vuln/detail/CVE-2026-95503
• CWE-347 — Improper Verification of Cryptographic Signature: https://cwe.mitre.org/data/definitions/347.html
• MITRE ATT&CK T1557 — Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
• Keycloak project documentation and security advisories (Kerberos federation / SPNEGO): https://www.keycloak.org/documentation
• FIRST CVSS v3.1 Specification (vector interpretation): https://www.first.org/cvss/v3.1/specification-document

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-95503 in the provided intelligence. CISA KEV: NO. No public PoC, exploit code, or Nuclei template exists as of this report.