CVE-2018-14657
Keycloak Improper Bruteforce Detection
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
- Record
CVE-2018-14657- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-307
- Updated
- 2026-11-02
EUVDEUVD-2022-3113
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
- Record
EUVD-2022-3113- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-85v8-vx4w-q684
Keycloak Improper Bruteforce Detection
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
- Record
GHSA-85v8-vx4w-q684- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-307
- Updated
- 2026-11-02
NVD
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
- Record
CVE-2018-14657- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-307
- Updated
- 2026-11-02
OSV
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
- Record
CVE-2018-14657- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-85v8-vx4w-q684
Keycloak Improper Bruteforce Detection
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
- Record
GHSA-85v8-vx4w-q684- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-307
- Updated
- 2026-11-02
OSVRHSA-2018:3592
Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 6 security and bug fix update
- Record
RHSA-2018:3592- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2018:3593
Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 7 security and bug fix update
- Record
RHSA-2018:3593- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-parentMaven |
before 4.6.0.Final | 4.6.0.Final |
org.keycloak:keycloak-parentMaven |
before 4.6.0.Final, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
4.6.0.Final |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs |
before 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs |
before 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el6 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs |
before 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs |
before 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 | 0:3.4.14-1.Final_redhat_00001.1.jbcs.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14657 is a medium vulnerability (CVSS 5.4) in Keycloak, published November 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in org.keycloak:keycloak-parent 4.6.0.Final.
References
access.redhat.com/errata/RHSA-2018:3592
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14657
nvd.nist.gov/vuln/detail/CVE-2018-14657
github.com/advisories/GHSA-85v8-vx4w-q684
Show 26 moreShow less
issues.redhat.com/browse/JBEAP-15587
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3592.json
cve.org/CVERecord?id=CVE-2018-10894
Left out here: 43 versions. The JSON record has them.