7.4
High
CVE-2026-90997 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak 26.7 | 26.7.0 → < 26.7.4 | 26.7.4 |
| Red Hat Build of Keycloak | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2533141 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of keycloak
The 15 CVEs of keycloak →
CVE-2026-1609
A flaw was found in Keycloak
8.1
High
CVE-2025-12150
A flaw was found in Keycloak’s WebAuthn registration component
3.1
Low
CVE-2025-13467
A flaw was found in the Keycloak LDAP User Federation provider
5.5
Medium
CVE-2025-11538
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…
6.8
Medium