~ / search / GHSA-gc7q-jgjv-vjr2

GHSA-gc7q-jgjv-vjr2

Keycloak Services has a potential bypass of brute force protection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-4629

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 22.0.12 22.0.12
Maven org.keycloak:keycloak-services >= 23.0.0, < 24.0.7 24.0.7
Maven org.keycloak:keycloak-services >= 25.0.0, < 25.0.4 25.0.4

Details

As written in the advisory (Markdown source, shown as plain text).

If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user. **Acknowledgements:** Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.

References

External links from the advisory. They lead to third-party sites.