Keycloak: potential bypass of brute force protection
Priority LOW 36CWE-837Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-307.
Summary
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00793 56th percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-services (Maven): 22.0.12, 24.0.7, 25.0.4Red Hat: 7 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | keycloak | 24.0.3 | — | No fix listed | CNA |
| Red Hat | Red Hat Build of Keycloak | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Keycloak 22 | — | 22.0.12-1 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 22 | — | 22-17 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 22 | — | 22-20 | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | 18.0.16-1.redhat_00001.1.el7sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | 18.0.16-1.redhat_00001.1.el8sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | 18.0.16-1.redhat_00001.1.el9sso | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.6-52 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| — | org.keycloak:keycloak-services (Maven) | before 22.0.12 | 22.0.12 | Patch available | GHSA-gc7q-jgjv-vjr2 |
| — | org.keycloak:keycloak-services (Maven) | 23.0.0 to before 24.0.7 | 24.0.7 | Patch available | GHSA-gc7q-jgjv-vjr2 |
| — | org.keycloak:keycloak-services (Maven) | 25.0.0 to before 25.0.4 | 25.0.4 | Patch available | GHSA-gc7q-jgjv-vjr2 |
- keycloak Vendor— Affected 24.0.3 Fixed in — No fix listed CNA
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Keycloak 22 VendorRed Hat Affected — Fixed in 22.0.12-1 Patch available CNA
- Red Hat build of Keycloak 22 VendorRed Hat Affected — Fixed in 22-17 Patch available CNA
- Red Hat build of Keycloak 22 VendorRed Hat Affected — Fixed in 22-20 Patch available CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Single Sign-On 7.6 for RHEL 7 VendorRed Hat Affected — Fixed in 18.0.16-1.redhat_00001.1.el7sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 8 VendorRed Hat Affected — Fixed in 18.0.16-1.redhat_00001.1.el8sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 9 VendorRed Hat Affected — Fixed in 18.0.16-1.redhat_00001.1.el9sso Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.6-52 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- org.keycloak:keycloak-services (Maven) Vendor— Affected before 22.0.12 Fixed in 22.0.12 Patch available GHSA-gc7q-jgjv-vjr2
- org.keycloak:keycloak-services (Maven) Vendor— Affected 23.0.0 to before 24.0.7 Fixed in 24.0.7 Patch available GHSA-gc7q-jgjv-vjr2
- org.keycloak:keycloak-services (Maven) Vendor— Affected 25.0.0 to before 25.0.4 Fixed in 25.0.4 Patch available GHSA-gc7q-jgjv-vjr2
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* | before 24.0.3 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* | 22.0 to before 22.012 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:* | 7.6 to before 7.6.10 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* | 4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* | 4.12 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions before 24.0.3 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* Versions 22.0 to before 22.012 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:* Versions 7.6 to before 7.6.10 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-gc7q-jgjv-vjr2 org.keycloak:keycloak-services (Maven) Fixed in 22.0.12 Advisory →
- Fix · GHSA-gc7q-jgjv-vjr2 org.keycloak:keycloak-services (Maven) Fixed in 24.0.7 Advisory →
- Fix · GHSA-gc7q-jgjv-vjr2 org.keycloak:keycloak-services (Maven) Fixed in 25.0.4 Advisory →
Red Hat 7 advisories
- RHSA-2024:6497 Released 2024-09-09 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.10 for OpenShift image enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2024:6495 Released 2024-09-09 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.10 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.16-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.16-1.redhat_00001.1.el9sso
- RHSA-2024:6500 Released 2024-09-09 · Red Hat rating ModerateRed Hat build of Keycloak 22.0.12 Images Update
- Red Hat build of Keycloak 22 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Show 4 more Red Hat advisories
- RHSA-2024:6494 Released 2024-09-09 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.10 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.16-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.16-1.redhat_00001.1.el8sso
- RHSA-2024:6501 Released 2024-09-09 · Red Hat rating ModerateRed Hat build of Keycloak 22.0.12 Update
- Red Hat Build of Keycloak
- RHSA-2024:6493 Released 2024-09-09 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.10 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.16-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.16-1.redhat_00001.1.el7sso
- RHSA-2024:6499 Released 2024-09-09 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.10 security update
- Red Hat Single Sign-On 7
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Middleware Containers for OpenShift | Fixed | RHSA-2024:6497 |
| Red Hat Build of Keycloak | Fixed | RHSA-2024:6501 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2024:6499 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2024:6493 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2024:6494 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2024:6495 |
| Red Hat build of Keycloak 22 | Fixed | RHSA-2024:6500 |
Not affected: 1 product
- Red Hat JBoss Enterprise Application Platform 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4629
- 2026-10-03 Alias added: GHSA-gc7q-jgjv-vjr2
References
Advisory 10
Other 8
- https://github.com/keycloak/keycloak/security/advisories/GHSA-gc7q-jgjv-vjr2
- https://github.com/keycloak/keycloak/commit/d78b3072ffffbff3954bf9f3181e3daf8e93c1ab
- https://github.com/keycloak/keycloak/commit/c8053dd812d9b9f05b293f901b9dc39e061ebb88
- https://github.com/keycloak/keycloak/commit/b25c28458a562abda2f84fc684e59cce8577e562
- https://github.com/keycloak/keycloak/commit/99f92ad5fff5555d53930c2d32f8be3e08c514c1
- https://github.com/keycloak/keycloak/commit/461fa631dc55b9739c9ed8c49de9f5b213955200
- https://github.com/keycloak/keycloak/commit/2fb358e1a21c5387cdc11100ce3562b4dcfe5416
- https://github.com/keycloak/keycloak
More Red Hat Build Of Keycloak vulnerabilities
- TI-2026-02223 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider CVSS 3.1HIGH 8.1
- TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
- TI-2026-13740 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction CVSS 3.1CRITICAL 9.8
- TI-2026-13741 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation CVSS 3.1CRITICAL 9.1
- TI-2026-13106 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation CVSS 3.1HIGH 8.8
- TI-2026-02631 Authentication bypass in Red Hat build of Keycloak 26.2 CVSS 3.1HIGH 8.8
Sources
- CVE-2024-4629 · CVE Program
- CVE-2024-4629 · NVD
- FIRST EPSS
- GHSA-gc7q-jgjv-vjr2 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-4629 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences