REDHAT-BUG-2562005: Race Condition
A race condition vulnerability was found in Keycloak within the HOTP HMAC-based One-Time Password validation logic in keycloak-services. When a realm is configured with an HOTP policy, the operations to validate a submitted code and increment the HOTP counter are performed non-atomically and without concurrency locking. An attacker who has already obtained a valid users credentials and a single valid HOTP code can send multiple concurrent authentication requests to the OpenID Connect token endpoint. Because of the lack of synchronization, multiple requests may be validated against the same counter value before it is successfully incremented. This allows an attacker to bypass the one-time use restriction of the HOTP code and establish multiple concurrent authenticated sessions.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must already have a valid user's credentials and one valid HOTP code. They must then submit multiple authentication requests concurrently to the OpenID Connect token endpoint.
Which deployments are affected?
The issue applies to realms configured with an HOTP policy. The provided information does not identify other authentication policy configurations as affected.
What is the practical impact of successful exploitation?
A single HOTP code can be accepted by multiple concurrent requests, allowing the attacker to establish multiple authenticated sessions despite the one-time-use restriction.