CVE-2026-90997: Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-09-22
Weakness: CWE-294

Description

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

Affected products

Keycloak: from 26.7.0 before 26.7.4 — fixed in 26.7.4

How to fix

Upgrade to a fixed version: Keycloak 26.7.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-90997 or the next vulnerability affects your stack