Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.6
CVE-2020-1744: Keycloak OTP Login Failure Events Not Sent to Brute Force Protection
CVE-2020-1744 · published 6 years ago
Summary
Keycloak versions before 9.0.1 may not properly track login failure events for One-Time Password (OTP) authentication, potentially weakening brute force protection. This means an attacker may be able to guess login credentials more easily without being detected. Update to version 9.0.1 or later to ensure login failure events are properly recorded.
What to do
- Update keycloak org.keycloak:keycloak-core to version 9.0.1.
- Update redhat keycloak to version 9.0.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | keycloak | org.keycloak:keycloak-core |
< 9.0.1 Fix: upgrade to 9.0.1
|
| – | redhat | keycloak |
< 9.0.1 cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* |
Original advisory text
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the...
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
CWE-755Improper Handling of Exceptional Conditions
Timeline
Published24 Mar 2020
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta