A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Weakness
The product does not handle or incorrectly handles an exceptional condition.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Keycloak | Redhat | * | 9.0.1 (excluding) |
| Red Hat Runtimes Spring Boot 2.2.6 | RedHat | keycloak | * |
| Red Hat Single Sign-On 7.3 | RedHat | * | |
| Red Hat Single Sign-On 7.3 for RHEL 6 | RedHat | rh-sso7-keycloak-0:4.8.18-1.Final_redhat_00001.1.el6sso | * |
| Red Hat Single Sign-On 7.3 for RHEL 7 | RedHat | rh-sso7-keycloak-0:4.8.18-1.Final_redhat_00001.1.el7sso | * |
| Red Hat Single Sign-On 7.3 for RHEL 8 | RedHat | rh-sso7-keycloak-0:4.8.18-1.Final_redhat_00001.1.el8sso | * |
| Text-Only RHOAR | RedHat | * |