REDHAT-BUG-2533141: High severity Keycloak vulnerability
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.
Affected Software
Event History
Frequently Asked Questions
Does using MySQL or MariaDB alone make a Keycloak deployment affected?
The flaw is described for Keycloak deployments that use MySQL or MariaDB and are deployed in stateless mode. The provided information does not identify other database configurations as affected.
What does an attacker need to exploit the issue?
The attacker needs to intercept a single-use security artifact, such as a JWT client assertion, DPoP proof, or TOTP code. They can then replay that artifact to bypass replay protection.