CVE-2026-90997: Keycloak
High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.
Affected products
Published 2026-09-17. Last modified 2026-09-22.