Build Of Keycloak
CVE-2024-4629
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 17 maven packages depend on org.keycloak:keycloak-services (11 direct, 6 indirect)
Ecosystem-wide dependent count for version 23.0.0.
DescriptionNVD
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
AnalysisAI
A vulnerability was found in Keycloak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-837. A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems. Affected products include: Redhat Keycloak, Redhat Build Of Keycloak, Redhat Single Sign-On, Redhat Openshift Container Platform, Redhat Openshift Container Platform For Linuxone.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Build Of Keycloak
View allA misconfiguration flaw was found in Keycloak. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploita
Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowin
Privilege escalation in Red Hat Build of Keycloak allows low-privileged authenticated users to assume the permissions of
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. Rated high severity (CVSS
Keycloak's IdentityBrokerService.performLogin endpoint fails to enforce disabled Identity Provider restrictions, allowin
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across
A session fixation issue was discovered in the SAML adapters provided by Keycloak. Rated high severity (CVSS 7.1), this
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. Ra
Stored XSS in Keycloak's organization selection login page allows authenticated administrators with manage-realm or mana
Refresh token replay in Keycloak allows a remote attacker who has previously captured a user's refresh token to reuse th
Privilege escalation in Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) allows administrative users with the manag
An open redirect vulnerability was found in Keycloak. Rated medium severity (CVSS 6.1), this vulnerability is remotely e
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today