CVE-2024-4629: Keycloak: potential bypass of brute force protection

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-03 · updated 2026-06-17
Weakness: CWE-837

Description

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

Affected products

Red Hat build of Keycloak 26.4: from 22.0 before 22.012 — fixed in 22.012
Keycloak: before 24.0.3 — fixed in 24.0.3
Red Hat OpenShift Container Platform 4.18: 4.11, 4.12
RedHat Openshift Container Platform For Linuxone: 4.9, 4.10
RedHat Openshift Container Platform For Power: 4.9, 4.10
RedHat Openshift Container Platform Ibm Z Systems: 4.9, 4.10
Red Hat Single Sign-On: from 7.6 before 7.6.10 — fixed in 7.6.10

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 22.012; Keycloak 24.0.3; Red Hat Single Sign-On 7.6.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-4629 or the next vulnerability affects your stack