Description
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
Metrics
CVSS 3.1 4.2/10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Build of Keycloak | — |
| Red Hat | Red Hat Build of Keycloak | — |
| Red Hat | Red Hat Single Sign-On 7 | — |
References
Timeline
- Published
- Oct 29, 2026
- Last modified
- Oct 29, 2026
- NVD status
- Awaiting Analysis