Skip to main content

Improper Enforcement of a Single, Unique Action

CVE-2024-4629

Medium
6.5/10

Summary

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems. This issue affects Keycloak versions prior to 25.0.4.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-837 - Improper Enforcement of a Single, Unique Action

The software requires that an actor should only be able to perform an action once, or to have only one unique action, but the software does not enforce or improperly enforces this restriction.

References

Advisory Timeline

  • Published