CVE-2026-90997

Name of the Vulnerable Software and Affected Versions Keycloak versions 26.7.0 through 26.7.3

Description A flaw exists when the software is deployed in stateless mode using MySQL or MariaDB. A mismatch in row-count semantics between the database driver and the application logic allows the replay protection mechanism for single-use security artifacts to be bypassed. An attacker who intercepts artifacts such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes can replay them to gain unauthorized access to the login flow or the token endpoint.

Recommendations Update to version 26.7.4 or later. Set the JDBC parameter useAffectedRows=true.