CVE-2024-7318
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
keycloak-core
- Vendor
- Unknown
- Product
- Unknown
- Platforms
- Unknown
- Default status
unaffected- Package
- keycloak-core
- Package collection
- https://github.com/keycloak/keycloak
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 24.0.7 | Unavailable | None listed |
| 25.0.0 | affected | semver | 25.0.4 | Unavailable | None listed |
Red Hat Build of Keycloak
- Vendor
- Red Hat
- Product
- Red Hat Build of Keycloak
- Platforms
- Unknown
- Default status
unaffected- Package
- keycloak-core
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat build of Keycloak 24
- Vendor
- Red Hat
- Product
- Red Hat build of Keycloak 24
- Platforms
- Unknown
- Default status
affected- Package
- rhbk/keycloak-operator-bundle
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 24.0.7-4 | unaffected | rpm | * | Unavailable | None listed |
Red Hat build of Keycloak 24
- Vendor
- Red Hat
- Product
- Red Hat build of Keycloak 24
- Platforms
- Unknown
- Default status
affected- Package
- rhbk/keycloak-rhel9
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 24-16 | unaffected | rpm | * | Unavailable | None listed |
Red Hat build of Keycloak 24
- Vendor
- Red Hat
- Product
- Red Hat build of Keycloak 24
- Platforms
- Unknown
- Default status
affected- Package
- rhbk/keycloak-rhel9-operator
- Package collection
- https://catalog.redhat.com/software/containers/
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 24-16 | unaffected | rpm | * | Unavailable | None listed |