6.9

GHSA-8WM9-24QG-M5QJ: keycloak-services Maven

CVSS: 6.9v4.0MediumPublished
Published 03-09-2024Last modified 07-12-2024
Open JSON

Vulnerability summary

GHSA-8WM9-24QG-M5QJ is a medium (CVSS 6.9) vulnerability in keycloak-services Maven.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.9/10
010
Medium · v4.0 (OSV · Maven), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 03-09-2024
    PublishedVulnerability first disclosed.
  2. 07-12-2024
    Last modifiedVulnerability information updated.

Description

Duplicate Advisory: Keycloak has a brute force login protection bypass ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gc7q-jgjv-vjr2. This link is maintained to preserve external references. ## Original Description A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Org.keycloak1 product
  • keycloak-services< 24.0.4

1 vendor · 1 product

References

11 links
Show all 11 references