CVE-2026-118030: Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
Other sources
A race condition vulnerability was found in Keycloak within the HOTP HMAC-based One-Time Password validation logic in keycloak-services. When a realm is configured with an HOTP policy, the operations to validate a submitted code and increment the HOTP counter are performed non-atomically and without concurrency locking. An attacker who has already obtained a valid users credentials and a single valid HOTP code can send multiple concurrent authentication requests to the OpenID Connect token endpoint. Because of the lack of synchronization, multiple requests may be validated against the same counter value before it is successfully incremented. This allows an attacker to bypass the one-time use restriction of the HOTP code and establish multiple concurrent authenticated sessions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when a realm is configured with an HOTP policy. The affected authentication logic is in the keycloak-services component.
What does an attacker need to exploit the race condition?
The attacker must already possess a user's password and one valid HOTP code. They must send multiple authentication requests concurrently to the OpenID Connect token endpoint while that code is valid for the current counter value.
What is the practical impact of successful exploitation?
Multiple concurrent requests can be accepted using the same HOTP code before the counter update completes. This defeats the intended single-use restriction and can establish multiple concurrent authenticated sessions or token issuances.