The vulnerability is a mismatch in row-count semantics between the database driver and Keycloak's application logic when operating in stateless mode with MySQL or MariaDB. This flaw allows an attacker who intercepts single-use security artifacts – such as JWT client assertions, DPoP proofs, or one-time password codes – to replay them. Successful exploitation grants the attacker unauthorized access to the token endpoint or login flow, enabling access to protected resources without legitimate credentials.

The vulnerability affects deployments of Keycloak, the open‑source identity and access management solution, that are configured in stateless mode and use a MySQL or MariaDB database. Any installation of Keycloak running under these conditions is vulnerable, regardless of the specific minor or patch release, until a patch or upgrade is applied.

The CVSS score of 7.4 indicates a high severity of the flaw. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an attacker must intercept the one‑time security artifacts in transit or obtain them through other means. Because the flaw permits replay of sensitive artifacts, successful exploitation could lead to unauthorized authentication and access to protected endpoints. The risk is elevated for environments where stateless Keycloak is used with MySQL/MariaDB and where attackers have network visibility to capture the artifacts.