A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute.
A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.
Metrics
Affected Vendors & Products
References
History
Wed, 18 Sep 2024 08:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
CPEs | cpe:/a:redhat:build_keycloak:24 |
Mon, 09 Sep 2024 19:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
| |
Metrics |
threat_severity
|
ssvc
|
Mon, 09 Sep 2024 19:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid. | |
Title | Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity | |
First Time appeared |
Redhat
Redhat build Keycloak |
|
Weaknesses | CWE-324 | |
CPEs | cpe:/a:redhat:build_keycloak:22 cpe:/a:redhat:build_keycloak:24::el9 |
|
Vendors & Products |
Redhat
Redhat build Keycloak |
|
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2024-09-09T18:50:36.583Z
Updated: 2024-09-18T08:38:23.458Z
Reserved: 2024-07-31T03:04:15.355Z
Link: CVE-2024-7318
Vulnrichment
Updated: 2024-09-09T19:08:28.083Z
NVD
Status : Awaiting Analysis
Published: 2024-09-09T19:15:14.237
Modified: 2024-09-10T12:09:50.377
Link: CVE-2024-7318
Redhat