CVE-2024-4629CWE-837

Keycloak: potential bypass of brute force protection

Medium · published September 3, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00793 · 55.9th percentile
Weakness
CWE-837 · Improper Enforcement of a Single, Unique Action
Published
2024-09-03T19:42Z
EPSS history
Timeline
  • 03 SEP 19:42Z
    Keycloak: potential bypass of brute force protection
    cvelistv5