AIKIDO-2026-231234

TL;DR

keycloak-model-jpa records single use objects with an upsert and accepts the write as a first use when the database reports one affected row. On MySQL and MariaDB, the default driver reports a matched but unchanged row as one affected row, so putIfAbsent returns success for a key that is already stored. An attacker who intercepts a JWT client assertion, a DPoP proof, or a TOTP code can submit that artifact again at the token endpoint or login flow and obtain unauthorized access. The fix deletes expired rows and uses INSERT IGNORE on those databases so a reused key does not count as a new insert.