CVE-2026-112201— Keycloak-services: keycloak-services: login-failure upsert trusts mysql/mariadb affected-row count

Quick assessment

Affected

Keycloak keycloak-services

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Keycloak（一个身份与访问管理解决方案）的登录失败存储组件中发现了一个缺陷。该问题主要影响在 MySQL 或 MariaDB 数据库上运行的多节点部署。当同一账户同时发生多次登录失败时，同步错误可能导致系统进入重复循环，从而将用户记录在数据库中锁定。其后果是，该用户的合法登录尝试会被阻止并报错。此外，由于在此循环过程中部分失败未被正确记录，系统的暴力破解防护机制可能无法准确统计所有失败尝试次数。

CVSS 4.8 · Medium Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1110 · Brute Force T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Keycloak-services: keycloak-services: login-failure upsert trusts mysql/mariadb affected-row count

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This issue specifically affects deployments using MySQL or MariaDB databases in a multi-node configuration. When multiple failed login attempts occur simultaneously for the same account, a synchronization error can cause the system to enter a repetitive loop that locks the user's record in the database. This results in legitimate login attempts for that user being blocked and failing with an error. Furthermore, because some failures are not correctly recorded during this loop, the system's brute-force protection may not accurately count all failed attempts.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

使用共享资源的并发执行不恰当同步问题(竞争条件)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Keycloak	keycloak-services	26.8.0 ~ 26.8.1	-
Red Hat	Red Hat Build of Keycloak	-	`cpe:/a:redhat:build_keycloak:`
Red Hat	Red Hat Build of Keycloak	-	`cpe:/a:redhat:build_keycloak:`
Red Hat	Red Hat Single Sign-On 7	-	`cpe:/a:redhat:red_hat_single_sign_on:7`