CVE-2026-90997

Summary

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

Affected Software

VendorProductVersion RangeStatus
KeycloakKeycloak26.7.0 < 26.7.4affected

Weaknesses

  • CWE-294: Authentication Bypass by Capture-replay

Workarounds

To mitigate this issue, configure the JDBC connection string for MySQL/MariaDB to explicitly set useAffectedRows=true. This ensures the database driver correctly reports affected rows, preventing the replay protection bypass. This mitigation is applicable only when Keycloak is deployed in stateless mode and utilizes MySQL or MariaDB as its database. A restart of the Keycloak service will be required for the configuration change to take effect.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References