CVE-2024-4629
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS probability
- 0.79%
- CWE
- CWE-837
- Published
- 2024-09-03
- Last modified
- 2026-03-26
Affected products
- Red Hat Red Hat build of Keycloak 22
- Red Hat Red Hat build of Keycloak 22
- Red Hat Red Hat build of Keycloak 22
- Red Hat Red Hat Single Sign-On 7.6 for RHEL 7
- Red Hat Red Hat Single Sign-On 7.6 for RHEL 8
- Red Hat Red Hat Single Sign-On 7.6 for RHEL 9
- Red Hat RHEL-8 based Middleware Containers
Weakness type
Related vulnerabilities
- CVE-2026-86198 — PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
- CVE-2026-45734 — MyBB: Default CAPTCHA missing invalidation
- CVE-2026-42609 — Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
- CVE-2026-44601 — Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash...
- CVE-2025-62784 — InventoryGui allows item duplication in GUIs which use GuiStorageElement
- CVE-2025-62783 — InventoryGui affected by item duplication in GUIs which use GuiStorageElement
- CVE-2025-62782 — InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement
- CVE-2025-54315 — The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event...