high · CVSS v3 7.4
CVE-2026-90997
Keycloak in stateless mode with MySQL or MariaDB has a row-count mismatch that allows attackers to replay single-use tokens such as JWT clie
Overview
Keycloak in stateless mode with MySQL or MariaDB has a row-count mismatch that allows attackers to replay single-use tokens such as JWT client assertions, DPoP proofs, or TOTP codes. This flaw bypasses replay protection and can grant unauthorized access to the token endpoint or login flow.
Description
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.
Impact
Confidentiality: attackers can obtain new tokens or authenticate as legitimate users. Integrity: login flow can be subverted. Availability: not directly impacted. Defenders: administrators of Keycloak deployments using MySQL/MariaDB in stateless mode.
Remediation
Apply the latest Keycloak patch that addresses the row-count mismatch. If patching is delayed, disable stateless mode or switch to a supported database such as PostgreSQL. Update the MySQL/MariaDB driver to the latest stable release and monitor logs for repeated token usage.
Risk context
High severity (CVSS 7.4). No EPSS data available. Prompt patching is recommended to mitigate potential unauthorized access.
Affected products
- Keycloak
Scores
- Severity
- high
- CVSS v2
- 7.1
- CVSS v3
- 7.4
- CVSS v4
- —
- EPSS
- —