Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.

Etkilenen sürümler2 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-118030 Diğer

Kayıt geçmişi

1. 29 Eki 2026 09:22Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-117859Keycloak-services: keycloak-services: par single-use bypass via flow restart
• 5,3 CVE-2026-117688Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration
• 5,4 CVE-2026-117627Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
• 7,4 CVE-2026-114488Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding
• 6,5 CVE-2026-19610Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
• 4,2 CVE-2026-114438Keycloak'ta gerekli OTP kaydı, Update User Locale eylem sıralaması nedeniyle atlanabiliyor