Cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akeycloakkeycloak/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 17 Sep 2026 19:59:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKeycloak Stateless Mode Replay Vulnerability (CVE-2026-90997)https://feed.craftedsignal.io/briefs/2026-09-keycloak-replay-vulnerability/Thu, 17 Sep 2026 19:59:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-keycloak-replay-vulnerability/A row-count mismatch in Keycloak when using MySQL or MariaDB in stateless mode allows attackers to bypass replay protection for single-use security artifacts like JWT client assertions, DPoP proofs, or TOTP codes.CVE-2026-90997 is a security vulnerability in Keycloak that manifests when the application is configured in stateless mode while utilizing MySQL or MariaDB as the backend database. The issue arises from a semantic discrepancy in how row counts are handled by the database driver compared to Keycloak's internal application logic. This flaw permits the successful replay of single-use security artifacts that are intended to be consumed exactly once. An attacker capable of intercepting these artifacts - specifically JWT client assertions, DPoP proofs, or TOTP codes - can reuse them to gain unauthorized access to the token endpoint or bypass authentication flows. This vulnerability is critical for environments relying on stateless Keycloak deployments for identity and access management, as it undermines the fundamental security guarantees of one-time-use authentication mechanisms.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication protections, leading to unauthorized access to protected resources or elevated privileges within the identity provider. This poses a significant risk to organizations using Keycloak to secure API access or user logins, as an attacker with access to intercepted tokens can effectively masquerade as legitimate users or clients.

Recommendation

Prioritize the identification of all Keycloak deployments currently running in stateless mode that utilize MySQL or MariaDB backends. Evaluate available patches from the Keycloak project and apply them to all affected instances to remediate the underlying database driver logic mismatch. Since no specific IOCs are currently available, teams should monitor authentication logs for anomalous patterns of repeated token usage or multiple successful logins using the same short-lived authentication artifacts.

]]>highadvisoryidentity-managementauthentication-bypassvulnerabilityDenial of Service Vulnerability in Keycloak Theme Localizationhttps://feed.craftedsignal.io/briefs/2026-09-keycloak-dos/Wed, 16 Sep 2026 15:51:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-keycloak-dos/An unauthenticated denial-of-service vulnerability in Keycloak (CVE-2026-79651) allows attackers to exhaust server memory by injecting arbitrary locale tags into an unbounded cache.CVE-2026-79651 is a high-severity denial-of-service vulnerability located within the theme localization endpoints of the keycloak-services component. This component is responsible for managing authentication flows and UI themes. The vulnerability stems from improper validation and resource management, where the server accepts arbitrary, user-supplied locale tags from unauthenticated HTTP requests. These tags are subsequently stored in an in-memory cache without any capacity limits or TTL enforcement. By repeatedly submitting unique and randomized locale tags, an attacker can force the Keycloak application to populate the cache until the JVM heap is fully consumed, triggering an OutOfMemoryError and crashing the service. This attack requires no authentication and can be performed remotely against any exposed Keycloak instance, posing a significant availability risk to identity and access management infrastructures.

Impact

Successful exploitation results in a complete denial-of-service condition for the Keycloak instance. Because Keycloak serves as a central authentication provider, an outage directly impacts all downstream applications and services relying on it for OIDC or SAML authentication, potentially locking users out of corporate systems.

Recommendation

  1. Patch Keycloak instances by updating to the version containing the fix for CVE-2026-79651 immediately upon vendor release.
  2. Implement request rate limiting and monitoring on the /realms/{realm}/protocol/openid-connect/auth and theme-related endpoints to detect anomalous volumes of requests containing unique locale parameters.
  3. Review web server or reverse proxy logs (e.g., Nginx, Apache) for high-frequency requests targeting theme localization parameters that result in 500-series server error codes.
]]>lowadvisorydenial-of-servicevulnerabilityidentity-management