Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Keycloak Login Attempts Can Be Bypassed by Coordinated Attackers

CVE-2024-4629 · published 2 years ago
Summary

Attackers can bypass Keycloak's protection against repeated login attempts by sending many login requests at the same time. This allows them to try more passwords than intended, making it easier to guess a correct password and access accounts. To mitigate this risk, update to a patched version of Keycloak as soon as possible.

What to do
  • Update keycloak org.keycloak:keycloak-services to version 22.0.12.
  • Update keycloak org.keycloak:keycloak-services to version 24.0.7.
  • Update keycloak org.keycloak:keycloak-services to version 25.0.4.
  • Update keycloak to version 22.12.0.
  • Update redhat keycloak to version 24.0.3 or later.
  • Update redhat build_of_keycloak to version 22.012 or later.
  • Update redhat single_sign-on to version 7.6.10 or later.
Affected software
Ecosystem VendorProductAffected versions
– redhat openshift_container_platform_ibm_z_systems 4.9
4.10
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*
maven keycloak org.keycloak:keycloak-services < 22.0.12
>= 23.0.0, < 24.0.7
>= 25.0.0, < 25.0.4
Fix: upgrade to 22.0.12
– redhat keycloak < 24.0.3
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
– redhat build_of_keycloak >= 22.0, < 22.012
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
– redhat single_sign-on >= 7.6, < 7.6.10
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
– redhat openshift_container_platform 4.11
4.12
cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
– redhat openshift_container_platform_for_linuxone 4.9
4.10
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
– redhat openshift_container_platform_for_power 4.9
4.10
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
Bitnami – keycloak >= 22.0.0, < 22.12.0
Fix: upgrade to 22.12.0
Original advisory text
Keycloak: potential bypass of brute force protection
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
CWE-837Improper Enforcement of a Single, Unique Action
Timeline
Published3 Sep 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-gc7q-jgjv-vjr2 · GHSA
CVE-2024-4629 · NVD
BIT-keycloak-2024-4629 · OSV
CVE-2024-4629 · OSV
Track software like this
Free during beta