4.8
Medium
CVE-2024-7318 A vulnerability was found in Keycloak
Description
A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of Keycloak 24 24 | earliest → < 24-16 | 24-16 |
References
- RHSA-2024:6502 access.redhat.com
- RHSA-2024:6503 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2301876 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Build of Keycloak
The 266 CVEs of Red Hat Build of Keycloak →
CVE-2026-97847
Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
7.1
High
CVE-2026-97175
Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
8.8
High
CVE-2026-97174
Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
6.8
Medium
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
High