Medium severity5.6NVD Advisory· Published Mar 24, 2020· Updated Jun 17, 2026
CVE-2020-1744
CVE-2020-1744
Description
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-coreMaven | < 9.0.1 | 9.0.1 |
Affected products
8- ghsa-coords6 versionspkg:maven/org.keycloak/keycloak-corepkg:rpm/opensuse/ansible-10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-11&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-12&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-13&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-9&distro=openSUSE%20Tumbleweed
< 9.0.1+ 5 more
- (no CPE)range: < 9.0.1
- (no CPE)range: < 10.6.0-1.1
- (no CPE)range: < 11.11.0-1.1
- (no CPE)range: < 12.2.0-1.1
- (no CPE)range: < 13.7.0-1.1
- (no CPE)range: < 9.8.0-1.1
Patches
Vulnerability mechanics
References
4- access.redhat.com/security/cve/CVE-2020-1744nvdVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-4gf2-xv97-63m2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-1744ghsaADVISORY
News mentions
0No linked articles in our index yet.