---
id: "CVE-2026-112201"
page: "https://infrastack.ai/live/CVE-2026-112201"
kind: "vulnerability"
aliases: ["CVE-2026-112201"]
title: "Keycloak: concurrent failed logins can lock accounts on MySQL clusters"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["identity", "infrastructure", "keycloak", "mariadb", "mysql", "self-hosted"]
not_affected_if: ["non-mysql-database", "single-node"]
published_at: "2026-11-11T13:17:13+00:00"
first_seen_at: "2026-11-11T13:27:11+00:00"
updated_at: "2026-11-11T13:29:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112201", "first_seen_at": "2026-11-11T13:27:11+00:00"}]
exploit_sources: []
---

# Keycloak: concurrent failed logins can lock accounts on MySQL clusters

Link for people: https://infrastack.ai/live/CVE-2026-112201 (this .md is for agents)

In multi-node Keycloak deployments backed by MySQL or MariaDB, simultaneous failed login attempts for one account can cause a sync error that locks that user's database record. Legitimate logins for that user then fail, and some failed attempts are not counted by brute-force protection.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Keycloak deployment runs more than one node and uses MySQL or MariaDB as its database.
- Confirm the Keycloak version in use, for example with `kc.sh --version`; the sources do not list fixed versions.

## Timeline

- 2026-11-11T13:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112201

## From the sources

A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This issue specifically affects deployments using MySQL or MariaDB databases in a multi-node configuration. When multiple failed login attempts occur simultaneously for the same account, a synchronization error can cause the system to enter a repetitive loop that locks the user's record in the database. This results in legitimate login attempts for that user being blocked and failing with an error. Furthermore, because some failures are not correctly recorded during this loop, the system's brute-force protection may not accurately count all failed attempts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_