Timing Attack Vulnerability in Keycloak Services by Red Hat

CVE-2026-118030

What is CVE-2026-118030?

A security flaw exists in the HOTP authentication mechanism of Red Hat's Keycloak Services, which is designed for identity and access management. This issue arises from the system's handling of one-time passwords (OTPs), where the validation and internal counter update processes are conducted in two separate steps without appropriate locking mechanisms. An attacker who has a user's password may exploit this timing gap, allowing them to reuse a single one-time code to authenticate multiple sessions concurrently, thereby compromising the security integrity of the authentication process.

References