{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/keycloak-stateless-mode/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-90997"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Keycloak (Stateless Mode)"],"_cs_severities":["high"],"_cs_tags":["identity-management","authentication-bypass","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Keycloak"],"content_html":"\u003cp\u003eCVE-2026-90997 is a security vulnerability in Keycloak that manifests when the application is configured in stateless mode while utilizing MySQL or MariaDB as the backend database. The issue arises from a semantic discrepancy in how row counts are handled by the database driver compared to Keycloak's internal application logic. This flaw permits the successful replay of single-use security artifacts that are intended to be consumed exactly once. An attacker capable of intercepting these artifacts - specifically JWT client assertions, DPoP proofs, or TOTP codes - can reuse them to gain unauthorized access to the token endpoint or bypass authentication flows. This vulnerability is critical for environments relying on stateless Keycloak deployments for identity and access management, as it undermines the fundamental security guarantees of one-time-use authentication mechanisms.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to bypass authentication protections, leading to unauthorized access to protected resources or elevated privileges within the identity provider. This poses a significant risk to organizations using Keycloak to secure API access or user logins, as an attacker with access to intercepted tokens can effectively masquerade as legitimate users or clients.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification of all Keycloak deployments currently running in stateless mode that utilize MySQL or MariaDB backends. Evaluate available patches from the Keycloak project and apply them to all affected instances to remediate the underlying database driver logic mismatch. Since no specific IOCs are currently available, teams should monitor authentication logs for anomalous patterns of repeated token usage or multiple successful logins using the same short-lived authentication artifacts.\u003c/p\u003e\n","date_modified":"2026-09-17T19:59:10Z","date_published":"2026-09-17T19:59:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-keycloak-replay-vulnerability/","summary":"A row-count mismatch in Keycloak when using MySQL or MariaDB in stateless mode allows attackers to bypass replay protection for single-use security artifacts like JWT client assertions, DPoP proofs, or TOTP codes.","title":"Keycloak Stateless Mode Replay Vulnerability (CVE-2026-90997)","url":"https://feed.craftedsignal.io/briefs/2026-09-keycloak-replay-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Keycloak (Stateless Mode)","version":"https://jsonfeed.org/version/1.1"}