Login Failure Storage Flaw in Keycloak Affects Multi-Node Deployments Using MySQL or MariaDB

CVE-2026-112201

What is CVE-2026-112201?

A vulnerability exists within the login-failure storage component of Keycloak, the prominent identity and access management tool. This flaw is particularly significant for configurations utilizing MySQL or MariaDB databases in a multi-node environment. In scenarios where multiple concurrent failed login attempts are directed at the same account, a synchronization error can occur, triggering a cycle that locks the user's record in the database. Consequently, this lockout prevents legitimate login attempts from succeeding and results in error messages. Moreover, due to the loop's inefficiencies, certain login failures may not be accurately logged, undermining the efficacy of the system's brute-force protection mechanisms.

References