{"id":"CVE-2026-90997","revision":"254e16211d634f50a7ef34a7d58fc392","records":[{"revision":"254e16211d634f50a7ef34a7d58fc392","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90997","aliases":[],"title":"Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch","description":"A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.","state":0,"publishedAt":"2026-09-17T18:47:34.059+00:00","modifiedAt":"2026-09-25T06:42:50.534+00:00","affected":[{"ecosystem":"https://github.com/keycloak/keycloak","name":"keycloak-services","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Keycloak\",\n                    \"product\": \"Keycloak\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"26.7.0\",\n                            \"lessThan\": \"26.7.4\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageName\": \"keycloak-services\",\n                    \"collectionURL\": \"https://github.com/keycloak/keycloak\",\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhbk/keycloak-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Build of Keycloak\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhbk/keycloak-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Build of Keycloak\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9-operator\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4,"severity":"HIGH"}],"references":["https://access.redhat.com/security/cve/CVE-2026-90997","https://bugzilla.redhat.com/show_bug.cgi?id=2533141"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90997","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90997","identifiers":["CVE-2026-90997"]},"retained":false,"historicalAffected":[]}],"coverage":[]}