Red Hat Keycloak Bruteforce Protection improper enforcement of a single, unique action

Summaryinfo

A vulnerability has been found in Red Hat Keycloak, JBoss Enterprise Application Platform and Single Sign-On and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Bruteforce protection. The manipulation leads to improper enforcement of a single, unique action. This vulnerability is traded as CVE-2024-4629. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Red Hat Keycloak, JBoss Enterprise Application Platform and Single Sign-On (the affected version unknown). This issue affects an unknown part of the component Bruteforce Protection. The manipulation with an unknown input leads to a improper enforcement of a single, unique action vulnerability. Using CWE to declare the problem leads to CWE-837. The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction. Impacted is confidentiality. The summary by CVE is:

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

It is possible to read the advisory at access.redhat.com. The identification of this vulnerability is CVE-2024-4629 since 05/07/2024. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/07/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-2798). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Red Hat

Name

• JBoss Enterprise Application Platform
• Keycloak
• Single Sign-On

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion