CVE-2024-4629
Keycloak: potential bypass of brute force protection
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Keycloak: potential bypass of brute force protection
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
- Record
CVE-2024-4629- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-837
- Updated
- 2026-11-02
EUVDEUVD-2024-2798
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
- Record
EUVD-2024-2798- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gc7q-jgjv-vjr2
Keycloak Services has a potential bypass of brute force protection
If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.
Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
- Record
GHSA-gc7q-jgjv-vjr2- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-307, CWE-837
- Updated
- 2026-11-02
NVD
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
- Record
CVE-2024-4629- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-837
- Updated
- 2026-11-02
OSV
Keycloak: potential bypass of brute force protection
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
- Record
CVE-2024-4629- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-837
- Updated
- 2026-11-02
OSVGHSA-gc7q-jgjv-vjr2
Keycloak Services has a potential bypass of brute force protection
If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.
Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
- Record
GHSA-gc7q-jgjv-vjr2- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-307, CWE-837
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2024:6493
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 7
- Record
RHSA-2024:6493- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:6494
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 8
- Record
RHSA-2024:6494- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:6495
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 9
- Record
RHSA-2024:6495- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-keycloak-2024-4629 No score
Keycloak: potential bypass of brute force protection
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
- Record
BIT-keycloak-2024-4629- Updated
- 2026-11-02
Affected products
- redhat keycloak
- redhat build of keycloak
- redhat openshift container platform
- redhat openshift container platform for linuxone
- redhat openshift container platform for power
- redhat openshift container platform ibm z systems
- redhat single sign-on
- red hat build of keycloak
- red hat build of keycloak 22
- red hat jboss enterprise application platform 8
- red hat single sign-on 7
- red hat single sign-on 7.6 for rhel 7
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven |
before 22.0.12 | 22.0.12 |
org.keycloak:keycloak-servicesMaven |
23.0.0 up to 24.0.7 | 24.0.7 |
org.keycloak:keycloak-servicesMaven |
25.0.0 up to 25.0.4 | 25.0.4 |
keycloakBitnami |
22.0.0 up to 22.12.0 | 22.12.0 |
org.keycloak:keycloak-servicesMaven |
before 22.0.12, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
22.0.12 |
org.keycloak:keycloak-servicesMaven |
23.0.0 up to 24.0.7, plus listed versions 23.0.123.0.223.0.323.0.423.0.5 Show 8 moreShow less23.0.623.0.724.0.024.0.124.0.224.0.324.0.424.0.5 |
24.0.7 |
org.keycloak:keycloak-servicesMaven |
25.0.0 up to 25.0.4, plus listed versions 25.0.125.0.225.0.3 |
25.0.4 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 3 CVEs |
before 0:18.0.16-1.redhat_00001.1.el7sso | 0:18.0.16-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 3 CVEs |
before 0:18.0.16-1.redhat_00001.1.el7sso | 0:18.0.16-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 3 CVEs |
before 0:18.0.16-1.redhat_00001.1.el8sso | 0:18.0.16-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 3 CVEs |
before 0:18.0.16-1.redhat_00001.1.el8sso | 0:18.0.16-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 3 CVEs |
before 0:18.0.16-1.redhat_00001.1.el9sso | 0:18.0.16-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 3 CVEs |
before 0:18.0.16-1.redhat_00001.1.el9sso | 0:18.0.16-1.redhat_00001.1.el9sso |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-4629 is a medium vulnerability (CVSS 6.5) in Redhat Keycloak, published September 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in org.keycloak:keycloak-services 22.0.12.
References
access.redhat.com/errata/RHSA-2024:6493
Show 33 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2276761
security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system
github.com/hnsecurity/vulns/blob/main/HNS-2024-09-Keycloak.md
nvd.nist.gov/vuln/detail/CVE-2024-4629
catalog.redhat.com/software/containers
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6493.json
cve.org/CVERecord?id=CVE-2024-4629
Left out here: 110 versions. The JSON record has them.