CVE-2026-90997

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90997", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-14T14:53:37.815Z", "datePublished": "2026-09-17T18:47:34.059Z", "dateUpdated": "2026-09-25T06:42:50.534Z"}, "containers": {"cna": {"title": "Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow."}], "affected": [{"vendor": "Keycloak", "product": "Keycloak", "versions": [{"status": "affected", "version": "26.7.0", "lessThan": "26.7.4", "versionType": "semver"}], "packageName": "keycloak-services", "collectionURL": "https://github.com/keycloak/keycloak", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbk/keycloak-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:build_keycloak:"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbk/keycloak-rhel9-operator", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:build_keycloak:"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-90997", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533141", "name": "RHBZ#2533141", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-16T14:21:23.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-294", "description": "Authentication Bypass by Capture-replay", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-294: Authentication Bypass by Capture-replay", "workarounds": [{"lang": "en", "value": "To mitigate this issue, configure the JDBC connection string for MySQL/MariaDB to explicitly set `useAffectedRows=true`. This ensures the database driver correctly reports affected rows, preventing the replay protection bypass. This mitigation is applicable only when Keycloak is deployed in stateless mode and utilizes MySQL or MariaDB as its database. A restart of the Keycloak service will be required for the configuration change to take effect."}], "timeline": [{"lang": "en", "time": "2026-09-14T14:53:20.409Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-16T14:21:23.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Bruno Oliveira of IBM in collaboration with OpenAI for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-25T06:42:50.534Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-21T21:07:40.908040Z", "id": "CVE-2026-90997", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T21:07:53.300Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-90997", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-21T21:07:40.908040Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T21:07:48.577Z"}}], "cna": {"title": "Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch", "credits": [{"lang": "en", "value": "Red Hat would like to thank Bruno Oliveira of IBM in collaboration with OpenAI for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Keycloak", "product": "Keycloak", "versions": [{"status": "affected", "version": "26.7.0", "lessThan": "26.7.4", "versionType": "semver"}], "packageName": "keycloak-services", "collectionURL": "https://github.com/keycloak/keycloak", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-09-14T14:53:20.409Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-16T14:21:23.000Z", "value": "Made public."}], "datePublic": "2026-09-16T14:21:23.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-90997", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533141", "name": "RHBZ#2533141", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this issue, configure the JDBC connection string for MySQL/MariaDB to explicitly set `useAffectedRows=true`. This ensures the database driver correctly reports affected rows, preventing the replay protection bypass. This mitigation is applicable only when Keycloak is deployed in stateless mode and utilizes MySQL or MariaDB as its database. A restart of the Keycloak service will be required for the configuration change to take effect."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "Authentication Bypass by Capture-replay"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-25T06:42:50.534Z"}, "x_redhatCweChain": "CWE-294: Authentication Bypass by Capture-replay"}}, "cveMetadata": {"cveId": "CVE-2026-90997", "state": "PUBLISHED", "dateUpdated": "2026-09-25T06:42:50.534Z", "dateReserved": "2026-09-14T14:53:37.815Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-17T18:47:34.059Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/keycloak/keycloak", "defaultStatus": "unaffected", "packageName": "keycloak-services", "product": "Keycloak", "vendor": "Keycloak", "versions": [{"lessThan": "26.7.4", "status": "affected", "version": "26.7.0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "unaffected", "packageName": "rhbk/keycloak-rhel9", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "unaffected", "packageName": "rhbk/keycloak-rhel9-operator", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow."}], "id": "CVE-2026-90997", "lastModified": "2026-09-22T19:16:56.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90997", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-21T21:07:40.908040Z", "version": "2.0.3"}}]}, "published": "2026-09-17T19:17:06.740", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-90997"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533141"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "keycloak-services: Keycloak: Replay protection bypass leads to unauthorized access via database driver semantics mismatch", "id": "2533141", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533141"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-294", "details": ["A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, configure the JDBC connection string for MySQL/MariaDB to explicitly set `useAffectedRows=true`. This ensures the database driver correctly reports affected rows, preventing the replay protection bypass. This mitigation is applicable only when Keycloak is deployed in stateless mode and utilizes MySQL or MariaDB as its database. A restart of the Keycloak service will be required for the configuration change to take effect."}, "name": "CVE-2026-90997", "package_state": [{"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Not affected", "package_name": "rhbk/keycloak-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}], "public_date": "2026-09-16T14:21:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-90997\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-90997"], "statement": "This vulnerability in Keycloak, when deployed in stateless mode with MySQL or MariaDB, is of High impact. It allows an attacker to bypass replay protection for single-use security artifacts, such as JWT client assertions and TOTP codes, leading to unauthorized access. Exploitation requires an attacker to intercept these short-lived artifacts, which typically necessitates a Man-in-the-Middle position or application-level compromise.\nThis affects community only, it does not affect Red Hat build of Keycloak.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.7.0,26.7.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Keycloak", "source": "cna", "vendor": "Keycloak"}, "product": "keycloak", "vendor": "keycloak"}], "created": "2026-09-18T07:00:06.029837+00:00", "updated": "2026-09-18T07:30:05.644182+00:00", "vendors": ["keycloak", "keycloak$PRODUCT$keycloak"]}