{"id":"CVE-2024-4629","aliases":["BIT-keycloak-2024-4629","EUVD-2024-2798","GHSA-gc7q-jgjv-vjr2","RHSA-2024:6493","RHSA-2024:6494","RHSA-2024:6495"],"status":"published","title":"Keycloak: potential bypass of brute force protection","description":"A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00793,"percentile":0.56641,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-307","CWE-837"],"published":"2024-09-03T19:42:01Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-services","fixed_in":["22.0.12","24.0.7","25.0.4"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"keycloak","fixed_in":["22.12.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.0"},{"fixed":"24.0.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"25.0.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"keycloak","ranges":[{"type":"SEMVER","events":[{"introduced":"22.0.0"},{"fixed":"22.12.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.12"}]}],"versions":["1.0-alpha-1","1.0-alpha-1-12062013","1.0-alpha-2","1.0-alpha-3","1.0-alpha-4","1.0-beta-1","1.0-beta-1-20150521","1.0-beta-1-20150523","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-final","1.0-rc-1","1.0-rc-2","1.0.1.Final","1.0.2.Final","1.0.3.Final","1.0.4.Final","1.0.5.Final","1.1.0.Beta1","1.1.0.Beta2","1.1.0.Final","1.1.1.Final","1.2.0.Beta1","1.2.0.CR1","1.2.0.Final","1.3.0.Final","1.3.1.Final","1.4.0.Final","1.5.0-Final","1.5.0.Final","1.5.1.Final","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.Final","1.8.0.Alpha1","1.8.0.CR1","1.8.0.CR2","1.8.0.CR3","1.8.0.Final","1.8.1.Final","1.9.0.CR1","1.9.0.Final","1.9.1.Final","1.9.2.Final","1.9.3.Final","1.9.4.Final","1.9.5.Final","1.9.7.Final","1.9.8.Final","10.0.0","10.0.1","10.0.2","11.0.0","11.0.1","11.0.2","11.0.3","12.0.0","12.0.1","12.0.2","12.0.3","12.0.4","13.0.0","13.0.1","14.0.0","15.0.0","15.0.1","15.0.2","15.1.0","15.1.1","16.0.0","16.1.0","16.1.1","17.0.0","17.0.1","18.0.0","18.0.1","18.0.2","19.0.0","19.0.1","19.0.2","19.0.3","2.0.0.CR1","2.0.0.Final","2.1.0.CR1","2.1.0.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.3.0.CR1","2.3.0.Final","2.4.0.CR1","2.4.0.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.4.Final","2.5.5.Final","20.0.0","20.0.1","20.0.2","20.0.3","20.0.4","20.0.5","21.0.0","21.0.1","21.0.2","21.1.0","21.1.1","21.1.2","22.0.0","22.0.1","22.0.2","22.0.3","22.0.4","22.0.5","3.0.0.CR1","3.0.0.Final","3.1.0.CR1","3.1.0.Final","3.2.0.CR1","3.2.0.Final","3.2.1.Final","3.3.0.CR1","3.3.0.CR2","3.3.0.Final","3.4.0.CR1","3.4.0.Final","3.4.1.CR1","3.4.1.Final","3.4.2.Final","3.4.3.Final","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.Final","4.1.0.Final","4.2.0.Final","4.2.1.Final","4.3.0.Final","4.4.0.Final","4.5.0.Final","4.6.0.Final","4.7.0.Final","4.8.0.Final","4.8.1.Final","4.8.2.Final","4.8.3.Final","5.0.0","6.0.0","6.0.1","7.0.0","7.0.1","8.0.0","8.0.1","8.0.2","9.0.0","9.0.2","9.0.3"]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.0"},{"fixed":"24.0.7"}]}],"versions":["23.0.0","23.0.1","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","24.0.0","24.0.1","24.0.2","24.0.3","24.0.4","24.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"25.0.4"}]}],"versions":["25.0.0","25.0.1","25.0.2","25.0.3"]},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.16-1.redhat_00001.1.el7sso"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.16-1.redhat_00001.1.el7sso"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.16-1.redhat_00001.1.el8sso"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.16-1.redhat_00001.1.el8sso"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.16-1.redhat_00001.1.el9sso"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.16-1.redhat_00001.1.el9sso"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of keycloak 22"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"red hat single sign-on 7.6 for rhel 7"},{"vendor":"red hat","product":"red hat single sign-on 7.6 for rhel 8"},{"vendor":"red hat","product":"red hat single sign-on 7.6 for rhel 9"},{"vendor":"red hat","product":"rhel-8 based middleware containers"},{"vendor":"redhat","product":"build_of_keycloak"},{"vendor":"redhat","product":"keycloak"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"redhat","product":"openshift_container_platform_for_linuxone"},{"vendor":"redhat","product":"openshift_container_platform_for_power"},{"vendor":"redhat","product":"openshift_container_platform_ibm_z_systems"},{"vendor":"redhat","product":"single_sign-on"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:6493","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6494","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6495","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6497","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6499","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6500","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6501","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4629","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276761","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","advisory","report","web"]},{"url":"https://security.humanativaspa.it/an-analysis-of-the-keycloak-authentication-system/","tags":["web"]},{"url":"https://github.com/hnsecurity/vulns/blob/main/HNS-2024-09-Keycloak.md","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-gc7q-jgjv-vjr2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4629","tags":["web","advisory"]},{"url":"https://github.com/keycloak/keycloak/commit/d78b3072ffffbff3954bf9f3181e3daf8e93c1ab","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/commit/c8053dd812d9b9f05b293f901b9dc39e061ebb88","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/commit/b25c28458a562abda2f84fc684e59cce8577e562","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/commit/99f92ad5fff5555d53930c2d32f8be3e08c514c1","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/commit/461fa631dc55b9739c9ed8c49de9f5b213955200","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/commit/2fb358e1a21c5387cdc11100ce3562b4dcfe5416","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gc7q-jgjv-vjr2"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4629.json","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302064","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6493.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4629","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5967","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5967","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7341","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j76j-rqwj-jmvv","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6494.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6495.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-4629","title":"Keycloak: potential bypass of brute force protection","description":"A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.","status":"published","published":"2024-09-03T19:42:01.318Z","modified":"2026-03-26T23:13:50.144Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-837"],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-2798","description":"A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.","status":"published","published":"2024-09-03T19:42:01Z","modified":"2026-03-26T23:13:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:27.67679Z"}],"ghsa":[{"id":"GHSA-gc7q-jgjv-vjr2","title":"Keycloak Services has a potential bypass of brute force protection","description":"If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.\n\n**Acknowledgements:**\nSpecial thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.","status":"published","published":"2024-09-17T22:29:01Z","modified":"2024-09-17T22:29:01Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-307","CWE-837"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2024-4629","description":"A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.","status":"published","published":"2024-09-03T20:15:09.003Z","modified":"2026-06-17T08:02:17.673Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-837"],"updated_at":"2026-11-02T14:10:24.514378Z"}],"osv":[{"id":"CVE-2024-4629","title":"Keycloak: potential bypass of brute force protection","description":"A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.","status":"published","published":"2024-09-03T19:42:01.318Z","modified":"2026-10-28T02:31:05.938177153Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-837"],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"GHSA-gc7q-jgjv-vjr2","title":"Keycloak Services has a potential bypass of brute force protection","description":"If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user.\n\n**Acknowledgements:**\nSpecial thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.","status":"published","published":"2024-09-17T22:29:01Z","modified":"2026-09-10T03:50:18.336303825Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-307","CWE-837"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"RHSA-2024:6493","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 7","status":"published","published":"2024-09-27T17:08:03Z","modified":"2026-08-27T10:03:49Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6494","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 8","status":"published","published":"2024-09-27T17:09:45Z","modified":"2026-08-27T10:03:49Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6495","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 9","status":"published","published":"2024-09-27T17:08:54Z","modified":"2026-08-27T10:03:50Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"BIT-keycloak-2024-4629","title":"Keycloak: potential bypass of brute force protection","description":"A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.","status":"published","published":"2026-08-25T12:16:16.496Z","modified":"2026-09-08T08:48:06.814817115Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}