4.2
MediumCVSS 3.1 · from redhat
CVE-2026-118030
Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
keycloak-services · Race condition · CWE-362Affectedkeycloak-services, rhbk/keycloak-rhel9, keycloak-services
FixNo fix listed yet.
PublishedOct 29, 06:22 · redhat
ScoredOct 29 · 4.2 · redhat
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
From redhat
Affected and fixed versions
ProductAffectedFixed inkeycloak-servicesall versions–rhbk/keycloak-rhel9all versions–keycloak-servicesnot stated–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known