CVE-2024-4629: redhat build_of_keycloak
Vulnerability summary
CVE-2024-4629 is a medium (CVSS 6.5) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 03-09-2024PublishedVulnerability first disclosed.
- 26-03-2026Last modifiedVulnerability information updated.
Description
A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.79% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- build_of_keycloak≥ 22.0, < 22.012
- keycloak< 24.0.3
- openshift_container_platform4.11 | 4.12
- openshift_container_platform_for_linuxone4.9 | 4.10
- openshift_container_platform_for_power4.9 | 4.10
Org.keycloak1 product
- keycloak-services< 22.0.12 | ≥ 23.0.0, < 24.0.7 | ≥ 25.0.0, < 25.0.4
2 vendors · 8 products
References
20 linksShow all 20 references
- github.com/keycloak/keycloakPACKAGE