CVE Alert: CVE-2026-90997 – Keycloak

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak’s application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

This is a material authentication risk requiring expedited remediation, although KEV status, SSVC exploitation state, PoC availability and EPSS are not provided, so active exploitation urgency cannot be confirmed.

Successful abuse could turn a captured, normally single-use authentication artefact into unauthorised access to token issuance or login workflows. Likely attacker objectives include account takeover, service-account impersonation, access-token acquisition and subsequent abuse of privileged applications or APIs. The principal exposure is confidentiality and integrity rather than service availability.

### Most likely attack path

The attacker needs to obtain or intercept a valid one-time artefact, making exploitation dependent on a realistic capture opportunity and therefore more operationally demanding than a direct unauthenticated exploit. Network reachability is sufficient; no prior account or user interaction is expected, while the unchanged security scope limits the immediate trust-boundary spread. Nevertheless, issued tokens or authenticated sessions could enable lateral movement into connected services.

### Who is most exposed

Organisations running stateless deployments with the affected database-driver combination are the priority population, particularly internet-facing identity realms, federated login services and environments issuing tokens for administrative or machine identities.

Alert on repeated use of the same assertion, proof or one-time code.

Correlate duplicate artefact identifiers across source addresses, devices and time windows.

Review token-endpoint failures followed by successful authentication.

Hunt for unusual authentication from hosting providers or unfamiliar geographies.

### Mitigation and prioritisation

Apply the vendor’s fixed release as soon as change controls permit.

Treat exposed stateless instances as expedited remediation; no priority-1 designation is justified without KEV or EPSS evidence.

Temporarily prefer stateful deployment or restrict affected database combinations where feasible.

Rotate potentially replayed client credentials, signing keys and active sessions after patching.

Obtain EPSS, KEV, SSVC and PoC intelligence to refine ordering.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.