Reported by 2 outlets
CVE-2026-95503 Red Hat Keycloak Kerberos auth flaw
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 2.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
CVE-2026-95503 is a Red Hat Keycloak Kerberos federation flaw with CVSS 6.8, currently unpatched. A same-network attacker can spoof the KDC and take over accounts through the Kerberos authentication provider. The event notes isolation of Keycloak instances is recommended until a fix is available. This aligns with the existing Keycloak advisory and adds a social corroboration pointing to valtersit.com.
Timeline
-
original reporting
CVE-2026-95503 affects the Kerberos federation provider in Red Hat build of Keycloak. When Kerberos password authentication runs without SPN
access.redhat.com · 21d ago · September 22nd, 2026
CVE-2026-95503 affects the Kerberos federation provider in Red Hat build of Keycloak. When Kerberos password authentication runs without SPN
via Mastodon https://access.redhat.com/security/cve/CVE-2026-95503
-
update from www.valtersit.com
CVE-2026-95503 Keycloak Kerberos auth bypass, CVSS 6.8. Unpatched. Same-network attacker can spoof the KDC and take over accounts. Isolate K
www.valtersit.com · 11d ago · October 2nd, 2026
CVE-2026-95503 Keycloak Kerberos auth bypass, CVSS 6.8. Unpatched. Same-network attacker can spoof the KDC and take over accounts.