Executive brief
Keycloak, an open-source identity and access management platform, has a flaw when running in stateless mode with MySQL or MariaDB databases. An attacker can intercept and replay single-use security tokens (like JWT assertions, DPoP proofs, or one-time passwords) to gain unauthorized access to user accounts and authentication endpoints. This bypasses protections designed to prevent token reuse.
Technical details
A mismatch in row-count semantics between the MySQL/MariaDB driver and Keycloak's application logic allows replay protection checks to be bypassed in stateless deployments. The vulnerability affects single-use security artifacts including JWT client assertions, DPoP proofs, and TOTP codes. An attacker with the ability to intercept network traffic can capture these artifacts and replay them against the token endpoint or login flow, achieving unauthorized access without requiring valid credentials. The issue is specific to stateless mode deployments using MySQL or MariaDB and does not affect other database backends.
Affected products
- Red Hat Keycloak <UNKNOWN>
Timeline
- 2026-09-17: disclosed