A flaw was found in the org.keycloak.models.jpa package of Keycloak. The login-failure store contains a defect in its upsert logic that manifests when using MySQL or MariaDB. The issue occurs due to the way these databases report affected-row counts during concurrent transactions. In a multi-node deployment, if two unauthenticated users submit the first failed login attempt for the same account simultaneously, a race condition can trigger an infinite retry loop in one node. This loop persists until a transaction timeout occurs, during which time a database row lock is held.
Successful exploitation allows an unauthenticated remote attacker to:
Cause a temporary Denial of Service for specific user accounts by blocking all subsequent authentication requests until the database lock wait timeout expires.

Partially evade brute-force protection mechanisms, as failed attempts occurring during the race condition may not be recorded in the audit log.