Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*

2 briefs RSS
high advisory

Keycloak Stateless Mode Replay Vulnerability (CVE-2026-90997)

A row-count mismatch in Keycloak when using MySQL or MariaDB in stateless mode allows attackers to bypass replay protection for single-use security artifacts like JWT client assertions, DPoP proofs, or TOTP codes.

Keycloak identity-management authentication-bypass vulnerability
1t 1c
low advisory

Denial of Service Vulnerability in Keycloak Theme Localization

An unauthenticated denial-of-service vulnerability in Keycloak (CVE-2026-79651) allows attackers to exhaust server memory by injecting arbitrary locale tags into an unbounded cache.

Keycloak denial-of-service vulnerability identity-management
1r 1t 1c