Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2024-4629 A vulnerability was found in Keycloak

Description

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Build of Keycloak Versions non publiées
Red Hat build of Keycloak 22 22 premières → < 22-20 22-20
Red Hat Single Sign-On 7 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 7 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 8 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 9 Versions non publiées
RHEL-8 based Middleware Containers 7.6 premières → < 7.6-52 7.6-52
Red Hat JBoss Enterprise Application Platform 8 Versions non publiées
Red Hat Single Sign-On 7.0 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Build of Keycloak

Les 276 CVE de Red Hat Build of Keycloak →
CVE-2026-9797 Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator 6.5 Moyenne CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Moyenne CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Moyenne CVE-2026-96547 Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles 6.5 Moyenne
Suivre cette CVE