Missing brute-force protection in Red Hat keycloak
Priority LOW 38CWE-307Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-307.
Summary
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
Why it matters now
EPSS 0.01159 67th percentileScored 2026-11-07
Fix Partial org.keycloak:keycloak-parent (Maven): 4.6.0.FinalRed Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | keycloak | 4.2.1.Final, 4.3.0.Final | — | No fix listed | CNA |
| — | org.keycloak:keycloak-parent (Maven) | before 4.6.0.Final | 4.6.0.Final | Patch available | GHSA-85v8-vx4w-q684 |
- keycloak VendorRed Hat Affected 4.2.1.Final, 4.3.0.Final Fixed in — No fix listed CNA
- org.keycloak:keycloak-parent (Maven) Vendor— Affected before 4.6.0.Final Fixed in 4.6.0.Final Patch available GHSA-85v8-vx4w-q684
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:keycloak:4.2.1:*:*:*:*:*:*:* | 4.2.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:keycloak:4.3.0:*:*:*:*:*:*:* | 4.3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:keycloak:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:keycloak:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
Remediation
- Fix · GHSA-85v8-vx4w-q684 org.keycloak:keycloak-parent (Maven) Fixed in 4.6.0.Final Advisory →
Red Hat 3 advisories
- RHSA-2018:3595 Released 2018-11-13 · Red Hat rating ModerateRed Hat Single Sign-On 7.2.5 security and bug fix update
- Red Hat Single Sign-On 7.2.5 zip
- RHSA-2018:3593 Released 2018-11-13 · Red Hat rating ModerateRed Hat Single Sign-On 7.2.5 on RHEL 7 security and bug fix update
- Red Hat Single Sign-On 7.2 for RHEL 7 Server rh-sso7-keycloak-3.4.14-1.Final_redhat_00001.1.jbcs.el7, rh-sso7-keycloak-server-3.4.14-1.Final_redhat_00001.1.jbcs.el7
- RHSA-2018:3592 Released 2018-11-13 · Red Hat rating ModerateRed Hat Single Sign-On 7.2.5 on RHEL 6 security and bug fix update
- Red Hat Single Sign-On 7.2 for RHEL 6 Server rh-sso7-keycloak-3.4.14-1.Final_redhat_00001.1.jbcs.el6, rh-sso7-keycloak-server-3.4.14-1.Final_redhat_00001.1.jbcs.el6
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Mobile Application Platform 4 | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7.2 for RHEL 6 Server | Fixed | RHSA-2018:3592 |
| Red Hat Single Sign-On 7.2 for RHEL 7 Server | Fixed | RHSA-2018:3593 |
| Red Hat Single Sign-On 7.2.5 zip | Fixed | RHSA-2018:3595 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-14657
- 2026-10-03 Alias added: GHSA-85v8-vx4w-q684
References
More Red Hat Keycloak vulnerabilities
- TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
- TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
- TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
- TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
Sources
- CVE-2018-14657 · CVE Program
- CVE-2018-14657 · NVD
- FIRST EPSS
- GHSA-85v8-vx4w-q684 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-14657 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences