Live › vulnerability › CVE-2026-118030
Keycloak's HOTP check validates a one-time password and updates its counter in two separate steps without locking. An attacker who already has a user's password can reuse one one-time code to log in several times at once.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 07:23 UTC. All times on this page are UTC.
Organizations running Keycloak as their identity provider with HOTP enabled as a second factor. The attacker needs the user's password, so the second factor is the only thing the race bypasses. Deployments that do not use HOTP are not affected by this description.
No product ranges from the sources yet.
kc.sh --version or the image tag.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
This page as .md · .json · in your agent: get_signal("CVE-2026-118030")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.