CVE-2026-90997: Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require attacker authentication or user interaction?
No. The severity vector indicates no privileges are required and no user interaction is required, although exploitation has high attack complexity.
Which deployments are exposed?
The affected scenario is Keycloak deployed in stateless mode with MySQL or MariaDB. The described impact is replay of intercepted single-use artifacts against the token endpoint or login flow.