7.4
Élevée
CVE-2026-90997 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| keycloak 26.7 | 26.7.0 → < 26.7.4 | 26.7.4 |
| Red Hat Build of Keycloak | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2533141 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de keycloak
Les 15 CVE de keycloak →
CVE-2026-1609
A flaw was found in Keycloak
8.1
Élevée
CVE-2025-12150
A flaw was found in Keycloak’s WebAuthn registration component
3.1
Faible
CVE-2025-13467
A flaw was found in the Keycloak LDAP User Federation provider
5.5
Moyenne
CVE-2025-11538
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…
6.8
Moyenne