EUVD-2026-112640
GHSA-hx7p-ffjf-vx59
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain victim's password and one valid HOTP code
-
ExploitSubmit multiple simultaneous authentication requests
-
ExecutionExploit unlocked validate-then-update counter window
-
ImpactReuse single OTP for several concurrent logins
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already know the victim's password (PR:L) and possess or submit a single currently-valid HOTP one-time code, then issue multiple authentication requests simultaneously to hit the unlocked timing gap between OTP validation and counter update. Exploitation is specific to the HOTP authentication flow in the keycloak-services component as deployed in Red Hat build of Keycloak and Red Hat Single Sign-On 7. Realistic risk is sharply limited by three factors: valid credentials are a prerequisite, the attacker must reliably win a narrow race condition (reflected as AC:H), and the benefit is confined to reusing one OTP for concurrent logins rather than a full authentication bypass. |
| Impact | This is a medium-severity defense-in-depth weakness, not a high-priority emergency. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2) tells a consistent story: although the attack is network-reachable (AV:N), it carries high attack complexity (AC:H) because the attacker must win a narrow timing race between OTP validation and counter update, and it requires prior privileges (PR:L) - specifically knowledge of the victim's password. No EPSS score, KEV listing, or POC is present in the input, and the vuln.today Decision label is 'this_month' (routine remediation, not act_now/emergency). These signals agree rather than conflict: moderate CVSS, no exploitation evidence, and a mid-tier priority label all point to a real but low-urgency issue. The single most important limiting factor is PR:L - the attacker must already possess valid credentials, so this flaw erodes the single-use guarantee of HOTP rather than breaking authentication outright. Missing data: no EPSS, no KEV, no POC reference, and no fixed version is included in the provided evidence. |
| Exploit ScenarioDerived | An attacker who has already obtained a user's password (for example via phishing or credential reuse) observes or submits one valid HOTP code and fires multiple concurrent authentication requests to slip through the window between OTP validation and counter increment, obtaining several authenticated sessions from a single one-time code. No public exploit identified at time of analysis. The network vector is offset by high attack complexity, since the attacker must reliably win the race. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Keycloak's HOTP one-time-password authentication flow can accept the same code more than once: the keycloak-services component verifies the OTP and advances its stored counter in two non-atomic steps, so concurrent login requests can slip through the gap before the counter is updated. The attacker must already know the victim's password and hold one currently valid HOTP code, and must win a narrow race (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, 4.2), so the practical gain is replay of a single code for simultaneous sessions rather than an authentication bypass; Red Hat build of Keycloak and Red Hat Single Sign-On 7 are the affected distributions. This is a medium-severity, defense-in-depth weakness rather than an emergency - no public exploit code or active exploitation is identified at time of analysis, and the priority label places it in the normal monthly remediation cycle.
RemediationAI
No vendor-released patch version appears in the available data, so the first action is to track https://access.redhat.com/security/cve/CVE-2026-118030 and https://bugzilla.redhat.com/show_bug.cgi?id=2562005 for the fixed Red Hat build of Keycloak and Red Hat Single Sign-On 7 builds and apply them on the monthly cycle indicated by the priority label; absence of a published version here is not evidence that no fix exists. Until a fixed build is confirmed, interim measures target the race window and the credential prerequisite: move users off HOTP to TOTP or WebAuthn in the authentication policy where the token fleet allows it, accepting the user re-enrollment cost and the loss of hardware HOTP tokens; cap concurrent authentication requests per user or per realm at the front end or load balancer so simultaneous submissions of one code are serialized, accepting some added latency on legitimate parallel logins; and alert on multiple successful sessions created from the same credential and OTP within a short interval. Because the exploit presumes a known password, credential-stuffing and phishing detection on the HOTP-protected realm remains relevant. Validate any of these workarounds against the vendor advisory before relying on them.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HOTP (RFC 4226) is a counter-based one-time password scheme: the server stores a monotonically increasing counter per token and, on each login, recomputes the HMAC-based code for a small counter window, then persists the new counter so a code cannot be replayed. The flaw is a classic CWE-362 race condition - the validation step and the counter write-back in the HOTP authentication mechanism of keycloak-services are performed as two separate operations without holding a lock across them. Two (or more) authentication requests arriving with the same code can therefore both validate against the same pre-update counter value before either persists the increment, yielding more than one successful login from a single OTP. The affected code path is specifically the HOTP flow, contrasted with the time-based TOTP flow, and the CPE data ties the exposure to Red Hat's redistributions - Red Hat build of Keycloak and Red Hat Single Sign-On 7 - rather than to a single upstream version string. The supplied CPE entries use wildcard version fields, so no exact affected version range is derivable from the available data, and the sources do not describe the precise locking primitive, datastore, or clustering topology under which the window is widest.
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Requires valid credentials (PR:L) and winning a narrow validate-then-update timing race (AC:H); OTP reuse yields limited confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Affected Products (CPE)CVE.org
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Exploit-DB