#VU97628 Improper Authentication in Keycloak - CVE-2024-7318

Vulnerability identifier: #VU97628

Vulnerability risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-7318

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Keycloak
Server applications / Directory software, identity management

Vendor: Keycloak

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to the generated OTP token remains valid longer than its expiration time when using FreeOTP. This increases the attack window for malicious actors to abuse the system and compromise accounts.

Note, the expiration time is 30 seconds, while the token remains valid for 1 minute in total.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Keycloak: 20.0.0 - 25.0.4

---

External links
https://access.redhat.com/errata/RHSA-2024:6502
https://access.redhat.com/errata/RHSA-2024:6503
https://access.redhat.com/security/cve/CVE-2024-7318
https://bugzilla.redhat.com/show_bug.cgi?id=2301876
https://github.com/keycloak/keycloak/security/advisories/GHSA-xmmm-jw76-q7vg

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.