The flaw resides in the HOTP authentication routine of the keycloak‑services component. Because the OTP validation and internal counter increment occur as two separate steps without synchronization, a race condition can be exploited. An attacker who gains a user’s password can time the authentication requests so that the same one‑time password is accepted in multiple concurrent sessions, effectively bypassing the intended counter check. Based on the description, it is inferred that the attack vector involves exploiting the authentication service’s timing gap with valid user credentials. This weakness corresponds to CWE‑362.

The affected products listed by Red Hat are the Red Hat Build of Keycloak and the Red Hat Single Sign‑On 7 platform. Version information is not explicitly stated in the advisory, so any installation of these products at the time of the CVE report is potentially impacted.

The CVSS score is 4.2, indicating a moderate impact. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires possession of a user’s credentials and manipulation of the authentication flow; the attacker initiates multiple login attempts in parallel to trigger the race window. Because no public exploit code exists and no official mitigation has been released yet, the likelihood of widespread exploitation remains unclear but should be monitored.