Improper Authentication in Keycloak - CVE-2024-7318

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU97628

Improper Authentication in Keycloak - CVE-2024-7318

Published: September 20, 2024 / Updated: October 14, 2024


Vulnerability identifier: #VU97628
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-7318
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the generated OTP token remains valid longer than its expiration time when using FreeOTP. This increases the attack window for malicious actors to abuse the system and compromise accounts.

Note, the expiration time is 30 seconds, while the token remains valid for 1 minute in total.


Affected software

Keycloak
Red Hat build of Keycloak

How to mitigate CVE-2024-7318

Install updates from vendor's website.

Keycloak - addressed in versions 22.0.12, 24.0.7, 25.0.5
Red Hat build of Keycloak - update to 24.0.7

External References

Related Security Bulletins