Brute Force Protection Flaw in Keycloak by Red Hat

CVE-2020-1744

Summary

A vulnerability exists in Keycloak that affects versions prior to 9.0.1, where the Conditional OTP Authentication Flow fails to log failed login attempts properly. When users attempt to authenticate using One-Time Passwords (OTP) and fail, these events are not sent to the Brute Force Protection event queue. This oversight permits an attacker to potentially exploit the authentication flow without triggering the intended brute force protections, thus increasing the risk of unauthorized access.

References