{"id":"CVE-2026-112201","kind":"vulnerability","aliases":["CVE-2026-112201"],"related":[],"title":"Keycloak: concurrent failed logins can lock accounts on MySQL clusters","description":"A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This issue specifically affects deployments using MySQL or MariaDB databases in a multi-node configuration. When multiple failed login attempts occur simultaneously for the same account, a synchronization error can cause the system to enter a repetitive loop that locks the user's record in the database. This results in legitimate login attempts for that user being blocked and failing with an error. Furthermore, because some failures are not correctly recorded during this loop, the system's brute-force protection may not accurately count all failed attempts.","summary":"In multi-node Keycloak deployments backed by MySQL or MariaDB, simultaneous failed login attempts for one account can cause a sync error that locks that user's database record. Legitimate logins for that user then fail, and some failed attempts are not counted by brute-force protection.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","infrastructure","keycloak","mariadb","mysql","self-hosted"],"not_affected_if":["non-mysql-database","single-node"],"how_to_check":"- Check whether the Keycloak deployment runs more than one node and uses MySQL or MariaDB as its database.\n- Confirm the Keycloak version in use, for example with `kc.sh --version`; the sources do not list fixed versions.","fix":null,"status":"open","published_at":"2026-11-11T13:17:13+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","triaged_at":"2026-11-11T13:29:42+00:00","updated_at":"2026-11-11T13:29:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T13:29:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: concurrent failed logins can lock accounts on MySQL clusters","impact":"low","summary":"In multi-node Keycloak deployments backed by MySQL or MariaDB, simultaneous failed login attempts for one account can cause a sync error that locks that user's database record. Legitimate logins for that user then fail, and some failed attempts are not counted by brute-force protection.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","mysql","mariadb","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"legitimate users locked out; brute-force protection undercounts failures","analyst_note":"Find the affected and fixed Keycloak versions at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-112201 or the Keycloak security advisories.","how_to_check":"- Check whether the Keycloak deployment runs more than one node and uses MySQL or MariaDB as its database.\n- Confirm the Keycloak version in use, for example with `kc.sh --version`; the sources do not list fixed versions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-node","non-mysql-database"],"who_is_affected":"Only deployments that run Keycloak in a multi-node configuration on a MySQL or MariaDB database are described as affected. Single-node setups or other databases are not named in the sources. The sources do not state which Keycloak versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4635,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112201':13A,16A '-2026':12A,15A 'access':90C 'account':7A,42B,119C 'accur':177C 'affect':96C 'attempt':39B,65B,113C,146C,181C 'back':31B 'block':151C 'brute':71B,172C 'brute-forc':70B,171C 'caus':44B,124C 'cluster':10A 'compon':84C 'concurr':2A 'configur':108C 'correct':163C 'count':68B,178C 'cve':11A,14A 'databas':53B,102C,140C 'deploy':30B,97C 'enter':128C 'error':47B,122C,156C 'fail':3A,37B,61B,64B,111C,153C,180C 'failur':82C,160C 'flaw':75C 'forc':72B,173C 'found':77C 'furthermor':157C 'host':24B 'ident':17B,88C 'infrastructur':18B 'issu':94C 'keycloak':1A,19B,29B,86C 'legitim':55B,144C 'lock':6A,49B,133C 'login':4A,38B,56B,81C,112C,145C 'login-failur':80C 'loop':131C,167C 'manag':91C 'mariadb':20B,35B,101C 'may':175C 'multi':27B,106C 'multi-nod':26B,105C 'multipl':110C 'mysql':9A,21B,33B,99C 'node':28B,107C 'occur':114C 'one':41B 'protect':73B,174C 'record':54B,137C,164C 'repetit':130C 'result':142C 'self':23B 'self-host':22B 'simultan':36B,115C 'solut':92C 'specif':95C 'storag':83C 'sync':46B 'synchron':121C 'system':126C,169C 'use':98C 'user':51B,59B,135C,149C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run Keycloak in a multi-node configuration on a MySQL or MariaDB database are described as affected. Single-node setups or other databases are not named in the sources. The sources do not state which Keycloak versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","infrastructure","keycloak","mariadb","medium","mysql","selfhosted"],"campaign_type":null,"search_a":"'-112201':13A,16A '-2026':12A,15A 'account':7A 'cluster':10A 'concurr':2A 'cve':11A,14A 'fail':3A 'keycloak':1A 'lock':6A 'login':4A 'mysql':9A","search_b":"'account':42B 'attempt':39B,65B 'back':31B 'brute':71B 'brute-forc':70B 'caus':44B 'count':68B 'databas':53B 'deploy':30B 'error':47B 'fail':37B,61B,64B 'forc':72B 'host':24B 'ident':17B 'infrastructur':18B 'keycloak':19B,29B 'legitim':55B 'lock':49B 'login':38B,56B 'mariadb':20B,35B 'multi':27B 'multi-nod':26B 'mysql':21B,33B 'node':28B 'one':41B 'protect':73B 'record':54B 'self':23B 'self-host':22B 'simultan':36B 'sync':46B 'user':51B,59B","search_c":"'access':90C 'account':119C 'accur':177C 'affect':96C 'attempt':113C,146C,181C 'block':151C 'brute':172C 'brute-forc':171C 'caus':124C 'compon':84C 'configur':108C 'correct':163C 'count':178C 'databas':102C,140C 'deploy':97C 'enter':128C 'error':122C,156C 'fail':111C,153C,180C 'failur':82C,160C 'flaw':75C 'forc':173C 'found':77C 'furthermor':157C 'ident':88C 'issu':94C 'keycloak':86C 'legitim':144C 'lock':133C 'login':81C,112C,145C 'login-failur':80C 'loop':131C,167C 'manag':91C 'mariadb':101C 'may':175C 'multi':106C 'multi-nod':105C 'multipl':110C 'mysql':99C 'node':107C 'occur':114C 'protect':174C 'record':137C,164C 'repetit':130C 'result':142C 'simultan':115C 'solut':92C 'specif':95C 'storag':83C 'synchron':121C 'system':126C,169C 'use':98C 'user':135C,149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112201","severity":null,"published_at":"2026-11-11T13:17:13+00:00","modified_at":"2026-11-11T13:17:13+00:00","first_seen_at":"2026-11-11T13:27:11+00:00","fetched_at":"2026-11-11T13:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}