CVE-2024-4629: Keycloak: potential bypass of brute force protection

Published Apr 23, 2024
·
Updated

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gc7q-jgjv-vjr2. This link is maintained to preserve external references.

Original Description A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

Other sources

If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.

Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.

GitHub

Summary: If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.

Requirements to exploit: Keycloak configured with Brute Force Protection

Component affected: org.keycloak:keycloak-services (Authentication)

Version affected: <= 24.0.3

Red Hat

Affected Software

21 affected componentsFixes available
redhat/Keycloak<24.0.3
24.0.3
maven/org.keycloak:keycloak-services<=24.0.3
24.0.4
maven/org.keycloak:keycloak-services>=25.0.0<25.0.4
25.0.4
maven/org.keycloak:keycloak-services>=23.0.0<24.0.7
24.0.7
maven/org.keycloak:keycloak-services<22.0.12
22.0.12
redhat keycloak<24.0.3
redhat Build Of Keycloak>=22.0<22.012
redhat Single Sign-on
All of the following
redhat Single Sign-on>=7.6<7.6.10
Any of the following
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
All of the following
Any of the following
redhat OpenShift Container Platform=4.11
redhat OpenShift Container Platform=4.12
redhat Openshift Container Platform For Linuxone=4.9
redhat Openshift Container Platform For Linuxone=4.10
redhat Openshift Container Platform For Power=4.9
redhat Openshift Container Platform For Power=4.10
redhat Openshift Container Platform Ibm Z Systems=4.9
redhat Openshift Container Platform Ibm Z Systems=4.10
redhat Enterprise Linux=8.0

Event History

Apr 23, 2024
Data Sourced
via Red Hat·09:22 PM
DescriptionSeverityAffected Software
Sep 3, 2024
CVE Published
via MITRE·07:42 PM
Data Sourced
via MITRE·07:42 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·09:31 PM
Sep 17, 2024
Withdrawn
via GitHub·10:22 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-4629?

CVE-2024-4629 has been classified as of moderate severity due to the potential for attackers to bypass brute force protection mechanisms.

2

How do I fix CVE-2024-4629?

To fix CVE-2024-4629, it is recommended to upgrade Keycloak to version 24.0.4 or later.

3

Which versions of Keycloak are affected by CVE-2024-4629?

Keycloak versions up to and including 24.0.3 are affected by CVE-2024-4629.

4

Is CVE-2024-4629 a public vulnerability?

Yes, CVE-2024-4629 has been publicly disclosed as it relates to a flaw in Keycloak.

5

What types of attacks does CVE-2024-4629 enable?

CVE-2024-4629 enables attackers to potentially bypass established brute force protections, making systems more vulnerable to unauthorized access.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203