CVE-2026-118030

CVE-2026-118030 · Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.

CVSS 4.2 · Средний · EPSS 0,2%

Опубликовано

2026-10-29T06:22:11.871Z

Обновлено

2026-10-29T14:18:44.865Z

Проверьте свой сервер →