A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NRed Hat Build Of Keycloak
APPRedhat22.0 – 24.0.7 (excl.)
Related vulnerabilities
Keycloak SAML Broker: pominięcie ograniczeń logowania w IdP-initiated SSO
Keycloak DCR: obejście polityki mapperów i eskalacja do admina
Keycloak DCR: fałszowanie ról administracyjnych przez User Property mapper
Keycloak: ominięcie polityki bezpieczeństwa przez nieprawidłową normalizację URI
Pominięcie weryfikacji podpisu SAML w Red Hat Build of Keycloak