CVE-2018-14657: Improper Restriction of Excessive Authentication Attempts

May 13, 2022 (updated July 20, 2023)

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

References

access.redhat.com/errata/RHSA-2018:3592
access.redhat.com/errata/RHSA-2018:3593
access.redhat.com/errata/RHSA-2018:3595
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14657
github.com/advisories/GHSA-85v8-vx4w-q684
nvd.nist.gov/vuln/detail/CVE-2018-14657

Code Behaviors & Features

Detect and mitigate CVE-2018-14657 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →