Riskcovery

CVE-2024-7318

Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity

State
Published
Severity
4.8 Medium
Published
Sep 9, 2024
Updated
Jan 26, 2026
Reserved
Jul 31, 2024

Read the record on cve.org

Description

A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.

Scores

CVSSScoreVectorSource
3.14.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:Nredhat

Weaknesses

  • CWE-324 Use of a Key Past its Expiration Date

Affected Products

ProductVersions
keycloak-core
  • before 24.0.7Affected
  • 25.0.0 to before 25.0.4Affected
Red Hat Build of KeycloakRed Hat
    Red Hat build of Keycloak 24Red Hat
    • 24.0.7-4 and laterNot affected
    Red Hat build of Keycloak 24Red Hat
    • 24-16 and laterNot affected
    Red Hat build of Keycloak 24Red Hat
    • 24-16 and laterNot affected

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.