Search for vulnerabilities
Vulnerability details: VCID-tpuz-5ntc-puc6
Vulnerability ID VCID-tpuz-5ntc-puc6
Aliases CVE-2024-7318
GHSA-xmmm-jw76-q7vg
Summary Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-324 Use of a Key Past its Expiration Date
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 4.8 https://access.redhat.com/errata/RHSA-2024:6502
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6502
ssvc Track https://access.redhat.com/errata/RHSA-2024:6502
cvssv3.1 4.8 https://access.redhat.com/errata/RHSA-2024:6503
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6503
ssvc Track https://access.redhat.com/errata/RHSA-2024:6503
cvssv3 4.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7318.json
cvssv3.1 4.8 https://access.redhat.com/security/cve/CVE-2024-7318
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2024-7318
ssvc Track https://access.redhat.com/security/cve/CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
cvssv3.1 4.8 https://bugzilla.redhat.com/show_bug.cgi?id=2301876
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2301876
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2301876
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-xmmm-jw76-q7vg
cvssv3.1 4.8 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 4.8 https://github.com/keycloak/keycloak/security/advisories/GHSA-xmmm-jw76-q7vg
cvssv3.1_qr MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-xmmm-jw76-q7vg
generic_textual MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-xmmm-jw76-q7vg
cvssv3.1 4.8 https://nvd.nist.gov/vuln/detail/CVE-2024-7318
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-7318
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2024:6502
https://access.redhat.com/errata/RHSA-2024:6503
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7318.json
https://access.redhat.com/security/cve/CVE-2024-7318
https://api.first.org/data/v1/epss?cve=CVE-2024-7318
https://bugzilla.redhat.com/show_bug.cgi?id=2301876
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/security/advisories/GHSA-xmmm-jw76-q7vg
https://nvd.nist.gov/vuln/detail/CVE-2024-7318
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
cpe:/a:redhat:build_keycloak:24 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:24
cpe:/a:redhat:build_keycloak:24::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:24::el9
GHSA-xmmm-jw76-q7vg https://github.com/advisories/GHSA-xmmm-jw76-q7vg
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:6502
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-09T19:08:16Z/ Found at https://access.redhat.com/errata/RHSA-2024:6502
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:6503
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-09T19:08:16Z/ Found at https://access.redhat.com/errata/RHSA-2024:6503
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7318.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/security/cve/CVE-2024-7318
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-09T19:08:16Z/ Found at https://access.redhat.com/security/cve/CVE-2024-7318
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2301876
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-09T19:08:16Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2301876
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak/security/advisories/GHSA-xmmm-jw76-q7vg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-7318
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.5637
EPSS Score 0.00344
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:29:41.376918+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-xmmm-jw76-q7vg/GHSA-xmmm-jw76-q7vg.json 37.0.0