CVE-2026-90997 Red Hat CVE debrief

Who should care

Defenders responsible for Keycloak deployments, especially those using stateless mode with MySQL or MariaDB, should assess their exposure and implement compensating controls to monitor and protect against replay attacks.

Why it matters

CVE-2026-90997 is a high-severity vulnerability in Keycloak that allows an attacker to bypass replay protection when deployed in stateless mode with MySQL or MariaDB. Defenders should prioritize verifying Keycloak deployments and assessing the exposure of security artifacts to prevent potential unauthorized access.

• Potential unauthorized access to the token endpoint or login flow.
• Reuse of single-use security artifacts like JWT client assertions, DPoP proofs, or one-time password codes.
• Need for verification of Keycloak deployments and exposure of security artifacts.
• Priority for implementing compensating controls to monitor and protect against replay attacks.

Technical summary

The vulnerability occurs due to a mismatch in row-count semantics between the database driver and Keycloak's application logic when deployed in stateless mode with MySQL or MariaDB. This allows an attacker to bypass replay protection and reuse single-use security artifacts, potentially granting unauthorized access to the token endpoint or login flow. Defenders should prioritize verifying Keycloak deployments and assessing the exposure of security artifacts to prevent potential unauthorized access. The issue is specific to Keycloak's interaction with MySQL or MariaDB in stateless mode.

Defensive priority

Defenders should prioritize verifying Keycloak deployments, especially those using stateless mode with MySQL or MariaDB, and assess the exposure of security artifacts.

Recommended defensive actions

• Verify Keycloak deployments, especially those using stateless mode with MySQL or MariaDB.
• Assess the exposure of security artifacts like JWT client assertions, DPoP proofs, or one-time password codes.
• Implement compensating controls to monitor and protect against replay attacks.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Red Hat has a reference page for this CVE. Defenders should verify Keycloak deployments, especially those using stateless mode with MySQL or MariaDB, and assess the exposure of security artifacts like JWT client assertions, DPoP proofs, or one-time password codes. The vulnerability allows an attacker to bypass replay protection and reuse single-use security artifacts. Evidence is limited to public CVE details and NVD assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.