Keycloak (Stateless Mode) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/keycloak-stateless-mode/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 17 Sep 2026 19:59:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKeycloak Stateless Mode Replay Vulnerability (CVE-2026-90997)https://feed.craftedsignal.io/briefs/2026-09-keycloak-replay-vulnerability/Thu, 17 Sep 2026 19:59:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-keycloak-replay-vulnerability/A row-count mismatch in Keycloak when using MySQL or MariaDB in stateless mode allows attackers to bypass replay protection for single-use security artifacts like JWT client assertions, DPoP proofs, or TOTP codes.CVE-2026-90997 is a security vulnerability in Keycloak that manifests when the application is configured in stateless mode while utilizing MySQL or MariaDB as the backend database. The issue arises from a semantic discrepancy in how row counts are handled by the database driver compared to Keycloak's internal application logic. This flaw permits the successful replay of single-use security artifacts that are intended to be consumed exactly once. An attacker capable of intercepting these artifacts - specifically JWT client assertions, DPoP proofs, or TOTP codes - can reuse them to gain unauthorized access to the token endpoint or bypass authentication flows. This vulnerability is critical for environments relying on stateless Keycloak deployments for identity and access management, as it undermines the fundamental security guarantees of one-time-use authentication mechanisms.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication protections, leading to unauthorized access to protected resources or elevated privileges within the identity provider. This poses a significant risk to organizations using Keycloak to secure API access or user logins, as an attacker with access to intercepted tokens can effectively masquerade as legitimate users or clients.

Recommendation

Prioritize the identification of all Keycloak deployments currently running in stateless mode that utilize MySQL or MariaDB backends. Evaluate available patches from the Keycloak project and apply them to all affected instances to remediate the underlying database driver logic mismatch. Since no specific IOCs are currently available, teams should monitor authentication logs for anomalous patterns of repeated token usage or multiple successful logins using the same short-lived authentication artifacts.

]]>highadvisoryidentity-managementauthentication-bypassvulnerability