🔐 CVE Alert

CVE-2024-1722

LOW 3.7

Keycloak-core: dos via account lockout

CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.

CWE CWE-645
Published Feb 27, 2024
Last Updated Nov 21, 2025
Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new low vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Affected Versions

Red Hat / Red Hat Build of Keycloak
All versions affected
Red Hat / Red Hat Single Sign-On 7
All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗
access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-1722 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2265389

Credits

Red Hat would like to thank Maor Abutbul (CyberArk) for reporting this issue.