VYPR
← All advisories
Medium severity6.5OSV Advisory· Published Sep 3, 2024· Updated Jun 17, 2026

CVE-2024-4629

CVE-2024-4629

Description

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-servicesMaven
< 22.0.1222.0.12
org.keycloak:keycloak-servicesMaven
>= 23.0.0, < 24.0.724.0.7
org.keycloak:keycloak-servicesMaven
>= 25.0.0, < 25.0.425.0.4

Affected products

14
  • Red Hat/Build Of KeycloakOSV2 versions
    1.0-alpha-1, 1.0-alpha-1-12062013, 1.0-alpha-2, …+ 1 more
    • (no CPE)range: 1.0-alpha-1, 1.0-alpha-1-12062013, 1.0-alpha-2, …
    • cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*range: >=22.0,<22.012
  • Red Hat/Keycloak
    cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
    Range: <24.0.3
  • Red Hat/Openshift Container Platform4 versions
    cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform For Linuxone2 versions
    cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform Ibm Z Systems2 versions
    cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*
  • Red Hat/Single Sign On2 versions
    cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*range: >=7.6,<7.6.10
    • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
  • ghsa-coords
    pkg:maven/org.keycloak/keycloak-services
    Range: < 22.0.12

Patches

Vulnerability mechanics

References

20

News mentions

0

No linked articles in our index yet.