CVEvulnerability

CVE-2024-4629

6.5 MEDIUM Published 2024-09-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-09-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-837

Description

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

Affected configurations

• redhat keycloak (< 24.0.3) • redhat build of keycloak (>= 22.0 < 22.012) • redhat single sign-on • redhat single sign-on (>= 7.6 < 7.6.10) • redhat openshift container platform 4.11 • redhat openshift container platform 4.12 • redhat openshift container platform for linuxone 4.9 • redhat openshift container platform for linuxone 4.10 • redhat openshift container platform for power 4.9 • redhat openshift container platform for power 4.10 • redhat openshift container platform ibm z systems 4.9 • redhat openshift container platform ibm z systems 4.10

Related

Weakness · CWE (1)

  • CWE-837 Improper Enforcement of a Single, Unique Action weakness

References