Bypass Replay Protection in Keycloak with MySQL or MariaDB

CVE-2026-90997

What is CVE-2026-90997?

A flaw exists in Keycloak when configured in stateless mode with MySQL or MariaDB, leading to a mismatch in row-count semantics between the database driver and Keycloak's logical handling. This discrepancy allows attackers to bypass replay protection mechanisms. By intercepting single-use security artifacts—such as JWT client assertions, DPoP proofs, or TOTP codes—an attacker can exploit this vulnerability to replay the intercepted tokens. Successful exploitation can result in unauthorized access to Keycloak's token endpoint or login processes, posing a significant risk to user credentials and security.

References