Homepage

Improper Enforcement of a Single The advisory has been revoked - it doesn't affect any version of package org.keycloak-keycloak-parent  (opens in a new tab)

Threat Intelligence

EPSS
0.79% (55th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-ORGKEYCLOAKKEYCLOAKPARENT-7891419
  • published4 Sept 2024
  • disclosed3 Sept 2024
Report a new vulnerability Found a mistake?

Introduced: 3 Sep 2024

CVE-2024-4629  (opens in a new tab)
CWE-837  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream org.keycloak-keycloak-parent package and not the org.keycloak-keycloak-parent package as distributed by RHEL.

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.