Description

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-22T08:16:43.200Z",
  "pubdate": "2026-09-22T08:16:43.200Z",
  "executiveSummary": "A critical authentication bypass vulnerability exists within the Keycloak Kerberos federation provider, specifically when processing password authentication without SPNEGO.\nThe flaw stems from a failure to perform mandatory server-side validation of the Key Distribution Center (KDC) by requesting a service ticket, rendering the identity verification process insecure.\nAn unauthenticated attacker positioned on the same network can intercept or facilitate authentication traffic to spoof the KDC, effectively bypassing the identity verification mechanism.\nSuccessful exploitation permits unauthorized access to arbitrary user accounts, leading to a complete compromise of the affected identity provider.\nThis vulnerability poses a significant risk to organizational security, as it allows attackers to masquerade as valid users without possessing valid credentials.\nThe attack is characterized by network-level spoofing, necessitating the attacker have proximity to the authentication traffic path to inject or redirect responses from the malicious KDC.",
  "technicalDetails": "The vulnerability resides in the implementation of the Kerberos federation provider component within Keycloak. Specifically, when the system is configured to perform Kerberos password authentication using legacy methods rather than the GSS-API/SPNEGO standard, the verification logic fails to confirm the legitimacy of the KDC.\nIn a secure Kerberos exchange, the client (or the service provider acting as a proxy) must verify the integrity of the KDC by requesting and validating a service ticket (or performing a mutual authentication handshake). The affected implementation omits this critical security control.\nThe attack flow commences with the attacker monitoring network traffic or utilizing ARP spoofing/man-in-the-middle techniques to position themselves between the Keycloak instance and the legitimate KDC. When a user attempts to authenticate via the Kerberos federation provider, the Keycloak instance initiates an authentication request.\nBecause Keycloak does not enforce KDC identity verification in this specific configuration, the attacker can present a malicious response packet that mimics a successful authentication reply from the KDC. Keycloak accepts this spoofed reply without verifying that it originated from a trusted entity through the standard ticket validation process.\nThe absence of a service ticket validation step means the application layer trust is placed entirely on the inbound packet content rather than cryptographic proof of identity. This facilitates a bypass where the attacker provides a positive authentication result, causing the Keycloak session management layer to generate an authenticated session token for the user account designated in the request.\nThe exploitation requires network-level access, allowing the adversary to intercept or influence the Kerberos protocol handshake. Once the bypass is successful, the attacker gains full control over the user account session, enabling post-exploitation actions consistent with the permissions assigned to the victim, including access to protected applications and sensitive data managed by Keycloak.\nThe vulnerability is restricted to environments utilizing non-SPNEGO Kerberos password authentication, representing a failure in the validation layer of the federation provider's internal state machine."
}