Description
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | keycloak | all keycloak versions prior to 9.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 4.8.18-1.Final_redhat_00001.1.el6sso | RHSA-2020:0947, RHSA-2020:0946, RHSA-2020:0945 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 | openSUSE-SU-2024:14536-1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 | openSUSE-SU-2025:15605-1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 | openSUSE-SU-2025:15753-1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 | openSUSE-SU-2026:10944-1 |
| openSUSE Tumbleweed | ansible-14 | 14.6.0-1.1 | openSUSE-SU-2026:12447-1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 | openSUSE-SU-2024:14244-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-core | < 9.0.1 | 9.0.1 | GHSA-4gf2-xv97-63m2 |
Advisories 10
- openSUSE-SU-2026:12447-1 ansible-14-14.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- RHSA-2020:0946 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.7 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:0947 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.7 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:0945 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.7 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2024-3589 Red Hat Single Sign On: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jun 7, 2026
- openSUSE-SU-2026:10944-1 ansible-13-13.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
- openSUSE-SU-2025:15605-1 ansible-11-11.11.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15753-1 ansible-12-12.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14536-1 ansible-10-10.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14244-1 ansible-9-9.8.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025