CVE-2026-90997Published
Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch
cve-program · CVE-2026-90997
Publishedkeycloak-services
https://github.com/keycloak/keycloak
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Keycloak",
"product": "Keycloak",
"versions": [
{
"status": "affected",
"version": "26.7.0",
"lessThan": "26.7.4",
"versionType": "semver"
}
],
"packageName": "keycloak-services",
"collectionURL": "https://github.com/keycloak/keycloak",
"defaultStatus": "unaffected"
}rhbk/keycloak-rhel9
https://access.redhat.com/downloads/content/package-browser/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
}rhbk/keycloak-rhel9-operator
https://access.redhat.com/downloads/content/package-browser/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9-operator",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
}Original source record · Cite this exact observation · Complete original publisher JSON