CVE-2024-4629: Keycloak: potential bypass of brute force protection
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gc7q-jgjv-vjr2. This link is maintained to preserve external references.
Original Description A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
Other sources
If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.
Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
— GitHub
Summary: If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.
Requirements to exploit: Keycloak configured with Brute Force Protection
Component affected: org.keycloak:keycloak-services (Authentication)
Version affected: <= 24.0.3
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4629?
CVE-2024-4629 has been classified as of moderate severity due to the potential for attackers to bypass brute force protection mechanisms.
How do I fix CVE-2024-4629?
To fix CVE-2024-4629, it is recommended to upgrade Keycloak to version 24.0.4 or later.
Which versions of Keycloak are affected by CVE-2024-4629?
Keycloak versions up to and including 24.0.3 are affected by CVE-2024-4629.
Is CVE-2024-4629 a public vulnerability?
Yes, CVE-2024-4629 has been publicly disclosed as it relates to a flaw in Keycloak.
What types of attacks does CVE-2024-4629 enable?
CVE-2024-4629 enables attackers to potentially bypass established brute force protections, making systems more vulnerable to unauthorized access.