Search for vulnerabilities
Vulnerability details: VCID-vbzs-5utm-tyh7
Vulnerability ID VCID-vbzs-5utm-tyh7
Aliases CVE-2024-7318
GHSA-57rh-gr4v-j5f6
Summary A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds (default). Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passcode that is valid longer than its expiration time increases the attack window for malicious actors to abuse the system and compromise accounts. Additionally, it increases the attack surface because at any given time, two OTPs are valid.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-324 Use of a Key Past its Expiration Date
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 4.8 https://access.redhat.com/errata/RHSA-2024:6502
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2024:6502
generic_textual HIGH https://access.redhat.com/errata/RHSA-2024:6502
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6502
cvssv3.1 4.8 https://access.redhat.com/errata/RHSA-2024:6503
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2024:6503
generic_textual HIGH https://access.redhat.com/errata/RHSA-2024:6503
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:6503
cvssv3 4.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7318.json
cvssv3.1 4.8 https://access.redhat.com/security/cve/CVE-2024-7318
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2024-7318
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00057 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00076 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00231 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00237 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00257 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
epss 0.00286 https://api.first.org/data/v1/epss?cve=CVE-2024-7318
cvssv3.1 4.8 https://bugzilla.redhat.com/show_bug.cgi?id=2301876
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2301876
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-57rh-gr4v-j5f6
cvssv3.1 4.8 https://github.com/keycloak/keycloak
cvssv3.1 6.8 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3 4.8 https://nvd.nist.gov/vuln/detail/CVE-2024-7318
cvssv3.1 4.8 https://nvd.nist.gov/vuln/detail/CVE-2024-7318
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-7318
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2024:6502
https://access.redhat.com/errata/RHSA-2024:6503
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7318.json
https://access.redhat.com/security/cve/CVE-2024-7318
https://api.first.org/data/v1/epss?cve=CVE-2024-7318
https://bugzilla.redhat.com/show_bug.cgi?id=2301876
https://github.com/keycloak/keycloak
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
cpe:/a:redhat:build_keycloak:22 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:22
cpe:/a:redhat:build_keycloak:24 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:24
cpe:/a:redhat:build_keycloak:24::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:24::el9
CVE-2024-7318 https://nvd.nist.gov/vuln/detail/CVE-2024-7318
GHSA-57rh-gr4v-j5f6 https://github.com/advisories/GHSA-57rh-gr4v-j5f6
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:6502
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:6502
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:6503
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2024:6503
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-7318.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/security/cve/CVE-2024-7318
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2301876
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-7318
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-7318
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.12358
EPSS Score 0.0005
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2024-09-17T19:12:17.226004+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-7318 34.0.1