Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity

Vulnerability

Description

A vulnerability was found in Keycloak's FreeOTP implementation, where one-time passcode (OTP) codes remain usable beyond their intended expiration period. When the OTP token period is set to the default of 30 seconds, expired codes are still accepted for an additional 30 seconds, effectively doubling the validity window to 1 minute [1][2]. This means at any given time, two OTP values are considered valid instead of one.

Exploitation

Context

This flaw can be exploited by an attacker who has obtained an OTP code, either through interception, phishing, or another means, within the extended validity period. The longer window for a valid OTP increases the likelihood that a captured code can be reused before it expires, especially in scenarios where an adversary has access to a previously observed token [2]. The attack does not require authentication or special network position beyond having possession of an OTP value.

Impact

Successful exploitation allows an attacker to authenticate as the targeted user using an OTP that should have expired. This weakens the security benefits of multi-factor authentication by prolonging the time an OTP is valid, thereby increasing the risk of account compromise [1][2]. The vulnerability is rated as moderate severity.

Mitigation

Red Hat released an advisory (RHSA-2024:6502) on September 9, 2024, updating Keycloak to version 24.0.7, which includes a fix for this issue [3]. Users are advised to update to the latest version. The open-source Keycloak project is available on GitHub, and users of community builds should apply the patch accordingly [4].