Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2026-90997

Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Keycloak Keycloak

Default version status: unaffected

  • 26.7.0 to < 26.7.4affected

Red Hat Red Hat Build of Keycloak

Default version status: unaffected

Red Hat Red Hat Build of Keycloak

Default version status: unaffected

References