Description

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

INFO

Published Date :

2024-09-03T19:42:01.318Z

Last Modified :

2026-03-26T23:13:50.144Z

Source :

redhat
AFFECTED PRODUCTS

The following products are affected by CVE-2024-4629 vulnerability.

Vendors Products
Redhat
  • Build Keycloak
  • Build Of Keycloak
  • Enterprise Linux
  • Jboss Enterprise Application Platform
  • Keycloak
  • Openshift Container Platform
  • Openshift Container Platform For Linuxone
  • Openshift Container Platform For Power
  • Openshift Container Platform Ibm Z Systems
  • Red Hat Single Sign On
  • Rhosemc
  • Single Sign-on
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-4629.

URL Resource
https://access.redhat.com/errata/RHSA-2024:6493 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6494 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6495 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6497 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6499 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6500 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:6501 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2024-4629 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2276761 cve-icon cve-icon
https://github.com/hnsecurity/vulns/blob/main/HNS-2024-09-Keycloak.md cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-4629 cve-icon
https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/ cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-4629 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact