VulnSocial

CVE-2026-90997Disclosure

LOWCVSS 7.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-294

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-17); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-17: 1Mentions · 2026-09-19: 1Patch / Workaround · 2026-09-19: 1Technical Details · 2026-09-17: 1Technical Details · 2026-09-19: 109-1709-19
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-09-171
Disclosure1
2026-09-191
Patch1
Full discourse2 posts
  • Cloud-IAM@cloud_iam_com
    Disclosure

    CVE-2026-90997:  When using MySQL or MariaDB as the database in stateless mode, the replay protection mechanism for single-use security artifacts fails to detect reuse due to a row-count semantics mismatch between the database driver's default configuration and 🧵

    Post summary

    The text discloses a specific replay-protection vulnerability affecting stateless mode with MySQL or MariaDB caused by a row-count semantics mismatch, without mentioning patches, PoC, exploits, or active exploitation.

    1002042
    215 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: Keycloak CVE-2026-90997 (CVSS 7.4) lets an attacker replay JWT assertions, DPoP proofs, or TOTP when Keycloak runs stateless on MySQL/MariaDB. Hits community 26.7.0–26.7.3. Upgrade to 26.7.4+ or set JDBC useAffectedRows=true. https://access.redhat.com/security/cve/cve-2026-90997

    Post summary

    The text confirms a Keycloak vulnerability (CVE-2026-90997) allowing JWT assertion replay under specific configurations, with a clear recommendation to upgrade to 26.7.4+ or apply a JDBC configuration fix.

    0000087
    3.0K followersView on X

Explore more

Back to dashboard